Repository navigation
Update dependency hashicorp/vault to v2 - #39
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
2 times, most recently
from
May 19, 2026 23:14
0805d72 to
d68f795
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
June 5, 2026 19:43
d68f795 to
339ffdc
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
June 17, 2026 22:59
339ffdc to
998e4a1
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
August 4, 2026 19:47
998e4a1 to
d43eb20
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
September 1, 2026 19:04
d43eb20 to
fecf245
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
September 16, 2026 23:52
fecf245 to
0cfb68e
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
September 24, 2026 20:47
0cfb68e to
b0a8a02
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
October 7, 2026 18:54
b0a8a02 to
66139be
Compare
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
October 15, 2026 20:56
66139be to
dc4c15d
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/hashicorp-vault-2.x
branch
from
October 22, 2026 23:51
dc4c15d to
e33a704
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v1.21.4→v2.2.1Release Notes
hashicorp/vault
v2.2.1Compare Source
v2.2.0Compare Source
October 15, 2026
BREAKING CHANGES:
cap_ipc_lockcapability onvaultat build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to callmlock()to lock memory. Operators should setdisable_mlock = truein Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.IPC_LOCKcapabilities when running the vault container.go-pgmultiauthto v1.1.0. Existing Managed Identity-based PostgreSQL configurations may stop working if Workload Identity is configured. Affected users must migrate PostgreSQL authentication to Workload Identity.sign-verbatimdirectory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can setdefault_directory_policy = "sign-verbatim-unsafe"inconfig/acme, accepting that the resulting certificates may contain unverified identity claims.SECURITY:
cloudflare/circlto v1.6.3 to resolve CVE-2026-1229filippo.io/edwards25519to v1.1.1 to resolve GO-2026-4503denied_parametersconstraint on thepoliciesrequest field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes thepoliciesparameter to lowercase before evaluatingallowed_parameters/denied_parametersconstraints.sys/raw, or replicated being able to run a binary outsideplugin_directory..or..) so traversal-style names are never resolved or applied.identity/scim/client/<name>, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.pathandfile_pathcannot be empty for requests tosys/audit/{path}max_token_header_sizelistener option (default 8 KB) to bound the size of authentication token headers (X-Vault-TokenandAuthorization: Bearer), preventing a potential denial-of-service attack via oversized header contents. The stdlib-levelMaxHeaderBytesbackstop is also now set on the HTTP server. Setmax_token_header_size = -1to disable the limit.identity/entity/mergeendpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM boundaries.cloudflare/circlto v1.6.3 to resolve CVE-2026-1229go.opentelemetry.io/otel/sdkto v1.40.0 to resolve GO-2026-4394CHANGES:
hcp_link_statusandhcp_link_resource_IDfields from thesys/seal-statusresponse.supplemental_audit_datacan now appear within audit entries of type "response" within the request and response data structures. These new fields can contain data that further describe the request/response data and are mainly used for non-JSON based requests and responses to help auditing. Theaudit-non-hmac-request-keysandaudit-non-hmac-response-keysapply to keys withinsupplemental_audit_datato remove the HMAC of the field values if so desired.auth/token/revoke-selfandauth/token/revoke-accessoris no longer supported.auth/token/revokeandauth/token/revoke-orphannow require the full JWT to revoke an OAuth JWT and reject the internal stored JWT ID form. Non-JWT Vault token behavior is unchanged.vault operator diagnoseno longer runs an HCP Link connectivity check, andvault statusno longer shows HCP Link status.vault statusno longer forces the root namespace when querying seal status. It now respects the namespace set viaVAULT_NAMESPACEor the-namespaceflag, consistent with other CLI commands.path "kv/*" { deny }could be bypassed forLIST kv/private/if a broader allowpath "kv/*"also existed. Policies relying on the previous (incorrect) behavior may now be denied.returns an array of string values for key usages, rather than an array of integer values. The strings used are 'encrypt' (1), 'decrypt' (2), 'sign' (3), 'verify' (4), 'wrap' (5), 'unwrap' (6), 'generate_random' (7), and 'mac' (8).
sys/config/oauth-resource-server/:namenow returns HTTP 200 with the full profile object instead of HTTP 204 with an empty body. Validation warnings are returned alongside the profile data rather than in place of it.plugin_directorywhenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused withplugin command is outside of configured plugin directory, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary insideplugin_directory..or..path segments are rejected for new policy writes and assignments, while names containing/and\remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.too many concurrent raft retry joins in progress).auth/approle/role/MyRole) no longer matches requests for that resource and must be rewritten using the lowercase name (auth/approle/role/myrole). The lowercased form is also what Sentinel RGP and EGP policies observe asrequest.path, so policy rules that compare that value against a mixed-case path (for examplerequest.path is "auth/approle/role/MyRole") must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.sys/mounts/auth/<path>/tune, matchingsys/auth/<path>/tune.path//to/resource)/./,/../, or//) to a cleaned path, instead of rejecting these requestscloudstanza in the server configuration no longer has any effect and will be unrecognized.force-identity-deduplicationactivation flag.sudocapability to invoke the identity entity merge API endpoint (identity/entity/merge).vault operator utilizationhave a changed format. Notably they contain an array ofsnapshot_recordsinstead ofsnapshots. Thedecoded_snapshotfield in each record contains the human-readable data that was previously in thesnapshotsarray.sys/activation-flags/oauth-resource-server/activateendpoint.FEATURES:
from FF3-1 to FF1.
tls_reload_intervaloption. When set, Vault periodically checkstls_cert_fileandtls_key_filefor changes and reloads the certificate automatically, so rotated certificates are picked up without restarting the node or sending SIGHUP.license_entitlementis required in the Vault config to use an IBM license. For more details, see the License documentation.enable_self_enrollmentparameter in the API.operator_namespace_pathto listener configuration to restrict HTTP access to a specific namespace subtree, enabling per-listener namespace isolation.POST /pki/keys/:uuid/exportendpoint wraps a CA private key with a caller-supplied public key using RSA-OAEP-SHA256, ECDH-ES, or ML-KEM. The destination Vault instance can import the blob viaPOST /pki/keys/importusingwrapped_keyandexport_key_hmac. Export events are recorded as tamper-evident audit records keyed on the SPKI fingerprint of the CA key, which survive delete-and-reimport cycles and surface as warnings on issuer reads.token_type=scimwith per-client active token limits and max TTL ceilings.Ed25519./transit/keys/:name/algorithmand/transit/keys/:name/import_version./vault/<cluster>/user-preferences) accessible from the account menu. Includes a Data & Privacy section with a telemetry consent toggle that persists per-browser in localStorage.vault-client, a smaller binary that includes Vault Agent, Vault Proxy, and the CLI commands for interacting with a Vault server, but not the server itself. It is available as zip bundles and Alpine container images.oauth_denylist.entries.gaugemetric to monitor active OAuth token denylist entries.IMPROVEMENTS:
sys/internal/counters/activity/cumulative. For each namespace in the response it returns the sum of its own client counts and that of all its child namespaces.localflag to agent registrations. Whenlocal=true, registrations are not replicated to other performance replication clusters and are kept local to the current cluster.start_monthandend_monthparameters to/sys/billing/overviewendpoint to allow querying billing data for specific time ranges.sys/reporting/scanendpoint which will output a set of files containing information about Vault state to the location specified by thereporting_scan_directoryconfig item.api/auth/aws), and the shared login-data helper (internal/awsutil/v2) from AWS SDK for Go v1 to v2.Ed25519public keys can now be registered viapublic_keysandsupported_algorithms = ["EdDSA"]is now accepted at configuration time and runtime.revoke-oauthendpoint to revoke an external OAuth token by its issuer and unique ID.sys/billing/configendpoint to allow configuration of billing data retention (min 13 months, max 6 years).library sets as part of both HWM role metrics and running-count product usage metric.
sys/billing/overviewendpoint that returns current and previous month consumption billing metrics. Accessible via API client methodclient.Sys().BillingOverview().sys/billing/overviewendpoint in admin namespace.sys/billing/overvieware now rounded to 4 decimal places./sys/internal/billing/overviewAPI endpoint now returns 37 months of historical consumption billing data by default.attribution_retention_monthsparameter onsys/billing/config(0–72 months, default 37). Setting to 0 disables attribution storage and immediately wipes all existing attribution data./sys/internal/billing/overviewAPI endpoint now always returns all metric types in the response, even when their values are zero. This ensures consistent response structure for easier client-side parsing.disallow_env_varsin PKCS#11 to allow per key configuration for RSA encryption algorithm.sys/config/ui/checklist-stateendpoint to persist and retrieve onboarding checklist progress.sys/config/oauth-resource-server/id/:config_idto read oauth resource server profiles byconfig_idvault.core.license.termination_time_epoch.typvalidation more permissive for tokens from IdPs such as Okta by allowing a missingtypheader, while restricting presenttypvalues toat+jwt,application/at+jwt, andJWT.deny_slash_in_templated_pathconfiguration option to reject the presence of slashes in rendered identity templates in policies, defaulting tofalse.vault.secret.engine.transform.role.countproduct usage metric reporting the number of Transform secret engine roles.vault.auth.method.cert.role.count,vault.auth.method.cert.crl.count,vault.auth.method.spiffe.role.count, andvault.auth.method.scep.role.countreporting the number of Cert auth roles and CRLs, SPIFFE auth roles, and SCEP auth roles across all namespaces and mounts, andvault.auth.method.spiffe_enabledreporting whether the SPIFFE auth method is enabled.deny_slash_in_templated_pathconfiguration option to reject the presence of slashes in rendered identity templates in policies, defaulting tofalse.rsa_oaep_hashto use for RSA-OAEP encryption with CKM_RSA_PKCS_OAEP mechanism.vault.route.read-snapshot.{mount_point}andvault.route.list-snapshot.{mount_point}metrics.sys/config/oauth-resource-servernow include amount_accessorfield containing the pre-assembled synthetic accessor string (oauth-resource-server_<namespace_id>_<config_id>). This is the accessor reported for profile-backed aliases in identity and audit output, and the value used to select those aliases in templated policies.sys/config/oauth-resource-servernow includes akey_infomap keyed by profile name, each entry carryingconfig_idandmount_accessor. Listed profile names are now sorted, and profiles whose details cannot be read are reported in a response warning.ui_settingsconfiguration stanza with aui_telemetryoption, surfaced to the UI via thesys/internal/ui/settingsendpoint, that gates anonymous UI usage telemetry.VAULT_STACKTRACE_FILE_PATH, and the dump can be suppressed with the config fielddisable_goroutine_trace_dump.VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZEenvironment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.profile_nameandconfig_idfields as shortcuts to resolve an OAuth Resource Server profile when creating entity aliases, without requiring amount_accessor. Resolving a profile also binds the alias to that profile's issuer, which OAuth Resource Server authentication requires. The fields are mutually exclusive with each other and withmount_accessor.POST identity/scim/client/<client-name>/link-entityendpoint to re-establish SCIM ownership over an unmanaged entity, restoring managed aliases and group memberships.POST identity/scim/client/<client-name>/link-groupandPOST identity/scim/client/<client-name>/unlink-groupadmin endpoints.link-grouptransfers ownership of an existing unmanaged Vault identity group to the named SCIM client; all current group members must already be owned by that client.unlink-groupremoves SCIM ownership from a group the client currently owns, returning it to unmanaged status.POST identity/scim/client/<client-name>/unlink-entityendpoint to remove the SCIM ownership link from an entity without deleting it.allow_user_adoptionfield to SCIM client configuration. When set totrue, aPOST /Usersrequest whoseuserNamematches an existing login alias will adopt the pre-existing entity rather than returning a conflict. Defaults tofalse.attributesandexcludedAttributesquery parameters on SCIM User and Group endpoints, allowing callers to request a subset or exclusion of attributes in responses per RFC 7644.GET /scim/v2/UsersandGET /scim/v2/Groupsendpoints per RFC 7644. Supported filters:userName eq,externalId eq,active eq, andmeta.lastModified gt/ge/lt/lefor Users;displayName eqandmeta.lastModified gt/ge/lt/lefor Groups. Unsupported filter expressions return HTTP 400.ServiceProviderConfignow advertisesfilter.supported: true.members[value eq "uuid"]foraddandreplaceoperations, matching the path format already supported forremove. This resolves an Okta error ("unsupported path") during Group Push membership updates. Group ownership mismatches now return 403 Forbidden (previously 404 Not Found); attempting to add/replace members owned by a different SCIM client now returns 403 (previously 400 with a not found-style detail).unlink_aliasesconsent parameter tounlink_secondary_aliasesand separated the response payload intounlinked_main_alias_idandunlinked_secondary_alias_ids.aliasesattribute. SCIM clients can push an array of{mount_accessor, name}entries onPOST,PUT, andPATCH /Usersto create, rename, or remove secondary aliases on an entity beyond the primary alias controlled byalias_mount_accessor.pathvalue in patch operationsexternalIdis now optional onPOST /Usersand is no longer required to be unique within a namespace. Multiple users may share the sameexternalIdvalue.issuer,edition,add_ons,license_start_time,license_expiration_time, andlicense_termination_time.allowed_parameters,denied_parameters, andrequired_parametersinsideauthorization_details.{{identity.entity.id}}) in Rich Authorization Requests (RAR).CEILING_POLICY_DENIED).vault.secure_hub_connectedCensus product usage metric to report whether a cluster is connected to the Secure Hub.groupsfield listing the direct group memberships managed by the requesting SCIM client, per RFC 7643.allowed_ipv4_cidrsinsource_awsandsource_azureconfiguration blocks to allow connections to explicitly permitted private IPv4 ranges.extra_subject_names_oidsfield to roles to allow specifying additional OID subject name components.supplemental_audit_datasection of audit log response entries. Details such as issuer_id, next_update, ocsp_status, serial_number, revoked_at will appear as hmac values by default unless added to the mount'saudit-non-hmac-response-keysset of keys.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.