$ cat hashicorp/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The dependency bump sits behind a new acceptance test that proves state written by 2.23.0, the last SDK v1 release, still reads in the current build.
chore: bump golang.org/x/net to v0.62.0 (CVE-2026-78661, CVE-2026-97045) (#509) hashicorp/terraform-provider-consul
The Consul provider picks up fixes for CVE-2026-78661 and CVE-2026-97045 by moving golang.org/x/net to v0.62.0. The input flags the change as breaking and names no fixed provider version, so pin deliberately rather than floating to latest.
test: add provider upgrade test and manual workflow hashicorp/terraform-provider-consul
`TestAccConsulProviderUpgrade` applies a config against `hashicorp/consul` 2.23.0 from the registry, then plans and refreshes with the current build to confirm state written by the last SDK v1 release reads unchanged. If you are still on 2.23.0, that exit path is now tested rather than assumed.
ci: split test matrices without jq's removed _nwise helper (#24106) hashicorp/consul
The "Generate Envoy Job Matrix" step failed with "_nwise/1 is not defined", per the change description, because jq 1.8 on GitHub's ubuntu-latest runners dropped the undocumented `_nwise` helper. The matrices are now split without it. Expect the same break in any Consul-adjacent CI script that leaned on that helper.
Cross-compile go-discover instead of building it under QEMU hashicorp/consul-ecs
The `go-discover` stage now pins to `$BUILDPLATFORM` and cross-compiles for `GOOS`, `GOARCH`, and `GOARM`, instead of compiling under emulation on arm and arm64. Image builds should get materially faster on those platforms.
Migrate kubernetes_role_binding_v1 to Plugin Framework hashicorp/terraform-provider-kubernetes
`kubernetes_role_binding_v1` now runs on the Plugin Framework via the incremental mux-based migration, with the input stating existing state and configuration stay compatible. The deprecated `kubernetes_role_binding` path is unchanged.
Migrate kubernetes_cluster_role_binding_v1 from SDKv2 to Plugin hashicorp/terraform-provider-kubernetes
The cluster-scoped counterpart moves from the SDKv2 implementation to `internal/framework/provider/rbacv1`, following the `kubernetes_role_v1` pattern. Together the two migrations take the RBAC resource family off SDKv2.
designcenter: add google_design_center_space resource hashicorp/terraform-provider-google
`google_design_center_space` arrives for Application Design Center, alongside new `actor_providers` and `oidc.discovery_uri` fields on `google_iam_workload_identity_pool_provider` and its data source. Workload identity pool configs can now declare provider fields they previously could not express.
remove the Beta status from SCIM API page (#3871) hashicorp/web-unified-docs
Alongside: SCIM is now GA in the 2.2 release and the Beta label is gone from its API page, Vault docs for PKI revocation reasons land across 1.19, 1.20, 1.21, and 2.x, and the `hpa-v2beta2` deprecation message was added.
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.