$ cat hashicorp/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
CVE-2026-5006 mitigation documented; Consul scanner turns failing
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Four Consul repos now fail the security scan on any detected CVE, and consul-esm bumps Consul to v2.0.4 to clear three.
Bump hashicorp/consul to v2.0.4 (a3eb721c21d4) to fix CVE-2026-87090,… hashicorp/consul-esm
consul-esm moves to Consul v2.0.4 to close CVE-2026-87090, CVE-2026-88021 and CVE-2026-15972. If you run the external server monitoring agent against an affected Consul build, this bump is the path off it.
update security scan workflow hashicorp/consul
The Consul scanner now fails the workflow outright when a CVE is detected instead of passing quietly, and reads suppressions from security-scan.hcl so existing waivers still apply. The same change lands in consul-dataplane and consul-k8s, which means forks and vendored copies of those workflows will start going red on findings they previously ignored.
docs: add CVE-2026-5006 mitigation changelog hashicorp/web-unified-docs
A mitigation entry for CVE-2026-5006 is now in the docs changelog. Read it before your next upgrade window if any of your deployments fall in the advisory's scope.
Document breaking change for agent registry mount (#3818) hashicorp/web-unified-docs
The docs now cover the agent registry mount introduced in Vault 2.2.0+, flagging its effect on upgrade times and the cleanup required before downgrading. Operators who roll forward past 2.2.0 and then try to roll back have a documented step to follow.
fix(ssm): add opt-in session restart after instance reboot (#719) hashicorp/packer-plugin-amazon
The Amazon builder gets an opt-in session_manager_reconnect_on_reboot option. It exists because AWS does not resume a Session Manager port forwarding session after an instance reboots, and session-manager-plugin does not always exit when its tunnel dies, so a reboot build can sit until timeout.
feat(AppTokens): Implement app token support hashicorp/terraform-provider-boundary
App token support lands in the Boundary provider, giving Terraform a managed resource for tokens that was previously outside the provider's surface.
`Icon` - Fix icons not loading in rendering tests on Ember 6.12.1+ hashicorp/design-system
On Ember 6.12.1+ with @ember/test-helpers 5.6+, renderComponent clears #ember-testing after the sprite root is added, so icons silently stopped loading in rendering tests. This fixes the registry-side handling for consumers running those versions.
Upgraded Terraform Policy syntax compatibility to v0.5.x hashicorp/terraform-ls
Alongside: terraform-ls takes Terraform Policy syntax compatibility to v0.5.x, the Amazon plugin refreshes its Go toolchain and copyright headers, and setup-packer bumps undici to 6.29.1.
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.