Skip to content

Releases: hashicorp/vault

v1.20.2

06 Aug 04:09
824d129
Compare
Choose a tag to compare

August 06, 2025

SECURITY:

BUG FIXES:

  • agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [GH-31392]
  • identity/mfa: revert cache entry change from #31217 and document cache entry values [GH-31421]

v1.20.1

24 Jul 20:10
b403b1a
Compare
Choose a tag to compare
[VAULT-38326] This is an automated pull request to build all artifact…

v1.20.0

25 Jun 13:57
6fdd6b5
Compare
Choose a tag to compare

1.20.0

June 25, 2025

SECURITY:

  • core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [GH-30794]

CHANGES:

  • UI: remove outdated and unneeded js string extensions [GH-29834]
  • activity (enterprise): The sys/internal/counters/activity endpoint will return actual values for new clients in the current month.
  • activity (enterprise): provided values for start_time and end_time in sys/internal/counters/activity are aligned to the corresponding billing period.
  • activity: provided value for end_time in sys/internal/counters/activity is now capped at the end of the last completed month. [GH-30164]
  • api: Update the default API client to check for the Retry-After header and, if it exists, wait for the specified duration before retrying the request. [GH-30887]
  • auth/alicloud: Update plugin to v0.21.0 [GH-30810]
  • auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
  • auth/azure: Update plugin to v0.20.3 [GH-30082]
  • auth/azure: Update plugin to v0.20.4 [GH-30543]
  • auth/azure: Update plugin to v0.21.0 [GH-30872]
  • auth/azure: Update plugin to v0.21.1 [GH-31010]
  • auth/cf: Update plugin to v0.20.1 [GH-30583]
  • auth/cf: Update plugin to v0.21.0 [GH-30842]
  • auth/gcp: Update plugin to v0.20.2 [GH-30081]
  • auth/jwt: Update plugin to v0.23.2 [GH-30431]
  • auth/jwt: Update plugin to v0.24.1 [GH-30876]
  • auth/kerberos: Update plugin to v0.15.0 [GH-30845]
  • auth/kubernetes: Update plugin to v0.22.1 [GH-30910]
  • auth/oci: Update plugin to v0.19.0 [GH-30841]
  • auth/saml: Update plugin to v0.6.0
  • core: Bump Go version to 1.24.4.
  • core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [GH-29774]
  • database/couchbase: Update plugin to v0.14.0 [GH-30836]
  • database/elasticsearch: Update plugin to v0.18.0 [GH-30796]
  • database/mongodbatlas: Update plugin to v0.15.0 [GH-30856]
  • database/redis-elasticache: Update plugin to v0.7.0 [GH-30785]
  • database/redis: Update plugin to v0.6.0 [GH-30797]
  • database/snowflake: Update plugin to v0.14.0 [GH-30748]
  • database/snowflake: Update plugin to v0.14.1 [GH-30868]
  • logical/system: add ent stub for plugin catalog handling [GH-30890]
  • quotas/rate-limit: Round up the Retry-After value to the nearest second when calculating the retry delay. [GH-30887]
  • secrets/ad: Update plugin to v0.21.0 [GH-30819]
  • secrets/alicloud: Update plugin to v0.20.0 [GH-30809]
  • secrets/azure: Update plugin to v0.21.2 [GH-30037]
  • secrets/azure: Update plugin to v0.21.3 [GH-30083]
  • secrets/azure: Update plugin to v0.22.0 [GH-30832]
  • secrets/gcp: Update plugin to v0.21.2 [GH-29970]
  • secrets/gcp: Update plugin to v0.21.3 [GH-30080]
  • secrets/gcp: Update plugin to v0.22.0 [GH-30846]
  • secrets/gcpkms: Update plugin to v0.21.0 [GH-30835]
  • secrets/kubernetes: Update plugin to v0.11.0 [GH-30855]
  • secrets/kv: Update plugin to v0.24.0 [GH-30826]
  • secrets/mongodbatlas: Update plugin to v0.15.0 [GH-30860]
  • secrets/openldap: Update plugin to v0.15.2 [GH-30079]
  • secrets/openldap: Update plugin to v0.15.4 [GH-30279]
  • secrets/openldap: Update plugin to v0.16.0 [GH-30844]
  • secrets/terraform: Update plugin to v0.12.0 [GH-30905]
  • server: disable_mlock configuration option is now required for integrated storage and no longer has a default. If you are using the default value with integrated storage, you must now explicitly set disable_mlock to true or false or Vault server will fail to start. [GH-29974]
  • ui/activity: Replaces mount and namespace attribution charts with a table to allow sorting
    client count data by namespace, mount_path, mount_type or number of clients for
    a selected month. [GH-30678]
  • ui: Client count side nav link 'Vault Usage Metrics' renamed to 'Client Usage' [GH-30765]
  • ui: Client counting "running total" charts now reflect new clients only [GH-30506]
  • ui: Removed FormError component (not used) [GH-34699]
  • ui: Selecting a different method in the login form no longer updates the /vault/auth?with= query parameter [GH-30500]
  • ui: /vault/auth?with= query parameter now exclusively refers to the auth mount path and renders a simplified form [GH-30500]

FEATURES:

  • Auto Irrevocable Lease Removal (Enterprise): Add the Vault Enterprise configuration param, remove_irrevocable_lease_after. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [GH-30703]
  • Development Cluster Configuration (Enterprise): Added development_cluster as a field to Vault's utilization reports.
    The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [GH-30659]
  • Entity-based and collective rate limit quotas (Enterprise): Add new group_by field to the rate limit quota API to support different grouping modes.
  • Login form customization (Enterprise): Adds support to choose a default and/or backup auth methods for the web UI login form to streamline the web UI login experience. [GH-30700]
  • Plugin Downloads: Support automatically downloading official HashiCorp secret and auth plugins from releases.hashicorp.com (beta)
  • SSH Key Signing Improvements (Enterprise): Add support for using managed keys to sign SSH keys in the SSH secrets engine.
  • Secret Recovery from Snapshot (Enterprise): Adds a framework to load an integrated storage
    snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot. [GH-30739]
  • UI Secrets Engines: TOTP secrets engine is now supported. [GH-29751]
  • UI Telemetry: Add Posthog for UI telemetry tracking on Vault Dedicated managed clusters [GH-30425]
  • Vault Namespace Picker: Updating the Vault Namespace Picker to enable search functionality, allow direct navigation to nested namespaces and improve accessibility. [GH-30490]
  • Vault PKI SCEP Server (Enterprise): Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.

IMPROVEMENTS:

  • activity (enterprise): Added vault.client.billing_period.activity telemetry metric to emit information about the total number of distinct clients used in the current billing period.
  • activity: mount_type was added to the API response of sys/internal/counters/activity [GH-30071]
  • activity: mount_type was added to the API response of sys/internal/counters/activity
  • api (enterprise): Added a new API, /sys/utilization-report, giving a snapshot overview of Vault's utilization at a high level.
  • api/client: Add Cert auth method support. This allows the client to authenticate using a client certificate. [GH-29546]
  • core (en...
Read more

v1.20.0-rc2

17 Jun 20:20
2b4cfe1
Compare
Choose a tag to compare
v1.20.0-rc2 Pre-release
Pre-release
[VAULT-37186] This is an automated pull request to build all artifact…

v1.20.0-rc1

12 Jun 00:00
83157a2
Compare
Choose a tag to compare
v1.20.0-rc1 Pre-release
Pre-release

1.20.0-rc1

June 11, 2025

SECURITY:

  • core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [GH-30794]

CHANGES:

  • UI: remove outdated and unneeded js string extensions [GH-29834]
  • activity (enterprise): The sys/internal/counters/activity endpoint will return actual values for new clients in the current month.
  • activity (enterprise): provided values for start_time and end_time in sys/internal/counters/activity are aligned to the corresponding billing period.
  • activity: provided value for end_time in sys/internal/counters/activity is now capped at the end of the last completed month. [GH-30164]
  • auth/alicloud: Update plugin to v0.21.0 [GH-30810]
  • auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
  • auth/azure: Update plugin to v0.20.3 [GH-30082]
  • auth/azure: Update plugin to v0.20.4 [GH-30543]
  • auth/cf: Update plugin to v0.20.1 [GH-30583]
  • auth/cf: Update plugin to v0.21.0 [GH-30842]
  • auth/gcp: Update plugin to v0.20.2 [GH-30081]
  • auth/jwt: Update plugin to v0.23.2 [GH-30431]
  • auth/jwt: Update plugin to v0.24.1 [GH-30876]
  • auth/kerberos: Update plugin to v0.15.0 [GH-30845]
  • auth/kubernetes: Update plugin to v0.22.1 [GH-30910]
  • auth/oci: Update plugin to v0.19.0 [GH-30841]
  • auth/saml: Update plugin to v0.6.0
  • core: Bump Go version to 1.24.4
  • core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [GH-29774]
  • database/couchbase: Update plugin to v0.14.0 [GH-30836]
  • database/elasticsearch: Update plugin to v0.18.0 [GH-30796]
  • database/mongodbatlas: Update plugin to v0.15.0 [GH-30856]
  • database/redis-elasticache: Update plugin to v0.7.0 [GH-30785]
  • database/redis: Update plugin to v0.6.0 [GH-30797]
  • database/snowflake: Update plugin to v0.14.0 [GH-30748]
  • secrets/ad: Update plugin to v0.21.0 [GH-30819]
  • secrets/alicloud: Update plugin to v0.20.0 [GH-30809]
  • secrets/azure: Update plugin to v0.21.2 [GH-30037]
  • secrets/azure: Update plugin to v0.21.3 [GH-30083]
  • secrets/azure: Update plugin to v0.22.0 [GH-30832]
  • secrets/gcp: Update plugin to v0.21.2 [GH-29970]
  • secrets/gcp: Update plugin to v0.21.3 [GH-30080]
  • secrets/gcp: Update plugin to v0.22.0 [GH-30846]
  • secrets/gcpkms: Update plugin to v0.21.0 [GH-30835]
  • secrets/kubernetes: Update plugin to v0.11.0 [GH-30855]
  • secrets/kv: Update plugin to v0.24.0 [GH-30826]
  • secrets/openldap: Update plugin to v0.15.2 [GH-30079]
  • secrets/openldap: Update plugin to v0.15.4 [GH-30279]
  • secrets/openldap: Update plugin to v0.16.0 [GH-30844]
  • server: disable_mlock configuration option is now required for integrated storage and no longer has a default. If you are using the default value with integrated storage, you must now explicitly set disable_mlock to true or false or Vault server will fail to start. [GH-29974]
  • ui/activity: Replaces mount and namespace attribution charts with a table to allow sorting
    client count data by namespace, mount_path, mount_type or number of clients for
    a selected month. [GH-30678]
  • ui: Client count side nav link 'Vault Usage Metrics' renamed to 'Client Usage' [GH-30765]
  • ui: Client counting "running total" charts now reflect new clients only [GH-30506]
  • ui: Removed FormError component (not used) [GH-34699]
  • ui: Selecting a different method in the login form no longer updates the /vault/auth?with= query parameter [GH-30500]
  • ui: /vault/auth?with= query parameter now exclusively refers to the auth mount path and renders a simplified form [GH-30500]

FEATURES:

  • Auto Irrevocable Lease Removal (Enterprise): Add the Vault Enterprise configuration param, remove_irrevocable_lease_after. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [GH-30703]
  • Development Cluster Configuration (enterprise): Added development_cluster as a field to Vault's utilization reports.
    The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [GH-30659]
  • Entity-based and collective rate limit quotas (enterprise): Add new group_by field to the rate limit quota API to support different grouping modes.
  • Login form customization (enterprise): Adds support to choose a default and/or backup auth methods for the web UI login form to streamline the web UI login experience. [GH-30700]
  • Secret Recovery from Snapshot (Enterprise): Adds a framework to load an integrated storage snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot.
  • SSH Key Signing Improvements (Enterprise): Add support for using managed keys to sign SSH keys in the SSH secrets engine.
  • UI Secrets Engines: TOTP secrets engine is now supported. [GH-29751]
  • UI Telemetry: add Posthog for UI telemetry tracking on HashiCorp Cloud-managed clusters [GH-30425]
  • Vault Namespace Picker: Updating the Vault Namespace Picker to enable search functionality, allow direct navigation to nested namespaces and improve accessibility. [GH-30490]
  • Vault PKI SCEP Server (Enterprise): Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.

IMPROVEMENTS:

  • activity (enterprise): Added vault.client.billing_period.activity telemetry metric to emit information about the total number of distinct clients used in the current billing period.
  • activity: mount_type was added to the API response of sys/internal/counters/activity [GH-30071]
  • api (enterprise): Added a new API, /sys/utilization-report, giving a snapshot overview of Vault's utilization at a high level.
  • api/client: Add Cert auth method support. This allows the client to authenticate using a client certificate. [GH-29546]
  • core (enterprise): allow a root token to relock a namespace locked by the Namespace API Lock feature.
  • core (enterprise): Updated code and documentation to support FIPS 140-3 compliant algorithms.
  • core (enterprise): report errors from the underlying seal when getting entropy.
  • core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
  • core/metrics: added a new telemetry metric, vault.core.response_status_code, with two labels, code, and type, detailing the status codes of all responses to requests that Vault handles. [GH-30354]
  • core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [GH-30576]
  • core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [GH-30603]
  • events: Add vault_index to an event's metadata if the metadata contains modified=true, to support client consistency controls when reading from Vault in response to an event where storage was modified. [GH-30725]
  • physical/postgres: Adds support to authenticate with the PostgreSQL Backend server with cloud based identities (AWS IAM, Azure MSI and GCP IA...
Read more

v1.19.5

29 May 22:59
7010adf
Compare
Choose a tag to compare

1.19.5

May 30, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

CHANGES:

  • database/snowflake: Update plugin to v0.13.1 [GH-30775]

IMPROVEMENTS:

  • plugins: Support registration of CE plugins with extracted artifact directory. [GH-30673]

BUG FIXES:

  • ui: Fix broken link to Hashicorp Vault developer site in the Web REPL help. [GH-30670]

v1.19.4

16 May 17:52
322786e
Compare
Choose a tag to compare

1.19.4

May 16, 2025

CHANGES:

  • Update vault-plugin-auth-cf to v0.20.1 [GH-30586]
  • auth/azure: Update plugin to v0.20.4 [GH-30543]
  • core: Bump Go version to 1.24.3.

IMPROVEMENTS:

  • Namespaces (enterprise): allow a root token to relock a namespace
  • core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
  • core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [GH-30576]
  • core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [GH-30603]
  • ui: Replaces all instances of the deprecated event.keyCode with event.key [GH-30493]

BUG FIXES:

  • core (enterprise): fix a bug where plugin automated root rotations would stop after seal/unseal operations
  • plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
    when it becomes active because standby nodes don't extract the artifact when the plugin
    is registered. Remove extracting from Vault and require the operator to place
    the extracted artifact in the plugin directory before registration.

v1.19.3

30 Apr 14:33
a2de3bb
Compare
Choose a tag to compare

1.19.3

April 30, 2025

CHANGES:

  • auth/jwt: Update plugin to v0.23.2 [GH-30434]

BUG FIXES:

  • core (enterprise): fix issue with errors being swallowed on failed HSM logins.
  • database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [GH-30320]
  • database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [GH-30327]
  • identity: Fix non-deterministic merge behavior when two entities have conflicting local aliases. [GH-30390]
  • plugins: plugin registration should honor the plugin_tmpdir config [GH-29978]
  • secrets/aws: fix a case where GovCloud wasn't taken into account; fix a case where the region setting wasn't respected [GH-30312]

v1.19.2

18 Apr 16:34
2ee4ea0
Compare
Choose a tag to compare

1.19.2

April 18, 2025

CHANGES:

  • core: Bump Go version to 1.23.7
  • core: Bump Go version to 1.23.8
  • secrets/openldap: Update plugin to v0.15.4 [GH-30279]

BUG FIXES:

  • secrets/openldap: Prevent static role rotation on upgrade when NextVaultRotation is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value. Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]
  • secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
  • secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain intermediate certificates. [GH-30034]
  • secrets/transit: fix a panic when rotating on a managed key returns an error [GH-30214]

v1.19.1

04 Apr 13:14
aa75903
Compare
Choose a tag to compare

1.19.1

April 4, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

CHANGES:

  • UI: remove outdated and unneeded js string extensions [GH-29834]
  • auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
  • auth/azure: Update plugin to v0.20.3 [GH-30082]
  • auth/gcp: Update plugin to v0.20.2 [GH-30081]
  • core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [GH-29774]
  • secrets/azure: Update plugin to v0.21.2 [GH-30037]
  • secrets/azure: Update plugin to v0.21.3 [GH-30083]
  • secrets/gcp: Update plugin to v0.21.2 [GH-29970]
  • secrets/gcp: Update plugin to v0.21.3 [GH-30080]
  • secrets/openldap: Update plugin to v0.15.2 [GH-30079]

IMPROVEMENTS:

  • activity: mount_type was added to the API response of sys/internal/counters/activity [GH-30071]
  • activity: mount_type was added to the API response of sys/internal/counters/activity
  • core (enterprise): report errors from the underlying seal when getting entropy.
  • storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [GH-29976]

BUG FIXES:

  • auth/aws: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
  • auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [GH-29922]
  • auth/ldap: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
  • aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set [GH-29996]
  • core (enterprise): add nil check before attempting to use Rotation Manager operations.
  • core: Fix a bug that prevents certain loggers from writing to a log file. [GH-29917]
  • identity: reintroduce RPC functionality for group creates, allowing performance standbys to handle external group changes during login and token renewal [GH-30069]
  • plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
  • secrets/aws: fix a bug where environment and shared credential providers were overriding the WIF configuration [GH-29982]
  • secrets/aws: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
  • secrets/db: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
  • secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store. [GH-29852]
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy