Releases: hashicorp/vault
Releases · hashicorp/vault
v1.15.0-rc1
1.15.0-rc1
September 13, 2023
SECURITY:
- secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]
CHANGES:
- auth/alicloud: Update plugin to v0.16.0 [GH-22646]
- auth/azure: Update plugin to v0.16.0 [GH-22277]
- auth/azure: Update plugin to v0.16.1 [GH-22795]
- auth/cf: Update plugin to v0.15.1 [GH-22758]
- auth/gcp: Update plugin to v0.16.1 [GH-22612]
- auth/jwt: Update plugin to v0.17.0 [GH-22678]
- auth/kerberos: Update plugin to v0.10.1 [GH-22797]
- auth/kubernetes: Update plugin to v0.17.0 [GH-22709]
- auth/kubernetes: Update plugin to v0.17.1 [GH-22879]
- auth/ldap: Normalize HTTP response codes when invalid credentials are provided [GH-21282]
- auth/oci: Update plugin to v0.14.2 [GH-22805]
- core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
which will have access to some system backend paths that were previously only accessible in the root namespace. [GH-21215] - core: Bump Go version to 1.21.1.
- database/couchbase: Update plugin to v0.9.3 [GH-22854]
- database/couchbase: Update plugin to v0.9.4 [GH-22871]
- database/elasticsearch: Update plugin to v0.13.3 [GH-22696]
- database/mongodbatlas: Update plugin to v0.10.1 [GH-22655]
- database/redis-elasticache: Update plugin to v0.2.2 [GH-22584]
- database/redis-elasticache: Update plugin to v0.2.3 [GH-22598]
- database/redis: Update plugin to v0.2.2 [GH-22654]
- database/snowflake: Update plugin to v0.9.0 [GH-22516]
- events:
data_path
will include full data path of secret, including name. [GH-22487] - replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
- sdk/logical/events:
EventSender
interface method is nowSendEvent
instead ofSend
. [GH-22487] - secrets/ad: Update plugin to v0.16.1 [GH-22856]
- secrets/alicloud: Update plugin to v0.15.1 [GH-22533]
- secrets/azure: Update plugin to v0.16.2 [GH-22799]
- secrets/azure: Update plugin to v0.16.3 [GH-22824]
- secrets/gcp: Update plugin to v0.17.0 [GH-22746]
- secrets/gcpkms: Update plugin to v0.15.1 [GH-22757]
- secrets/keymgmt: Update plugin to v0.9.3
- secrets/kubernetes: Update plugin to v0.6.0 [GH-22823]
- secrets/kv: Update plugin to v0.16.1 [GH-22716]
- secrets/mongodbatlas: Update plugin to v0.10.1 [GH-22748]
- secrets/openldap: Update plugin to v0.11.2 [GH-22734]
- secrets/terraform: Update plugin to v0.7.3 [GH-22907]
- secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
- storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [GH-20825]
- telemetry: Replace
vault.rollback.attempt.{MOUNT_POINT}
andvault.route.rollback.{MOUNT_POINT}
metrics withvault.rollback.attempt
andvault.route.rollback metrics
by default. Added a telemetry configurationadd_mount_point_rollback_metrics
which, when set to true, causes vault to emit the metrics with mount points in their names. [GH-22400]
FEATURES:
- Merkle Tree Corruption Detection (enterprise): Add a new endpoint to check merkle tree corruption.
- Copyable KV v2 paths in UI: KV v2 secret paths are copyable for use in CLI commands or API calls [GH-22551]
- Dashboard UI: Dashboard is now available in the UI as the new landing page. [GH-21057]
- Database Static Role Advanced TTL Management: Adds the ability to rotate
static roles on a defined schedule. [GH-22484] - GCP IAM Support: Adds support for IAM-based authentication to MySQL and PostgreSQL backends using Google Cloud SQL. [GH-22445]
- Improved KV V2 UI: Updated and restructured secret engine for KV (version 2 only) [GH-22559]
- Plugin Containers: Vault supports registering, managing, and running plugins inside a container on Linux. [GH-22712]
- SAML Auth Method (enterprise): Enable users to authenticate with Vault using their identity in a SAML Identity Provider.
- UI LDAP secrets engine: Add LDAP secrets engine to the UI. [GH-20790]
- Event System: Add subscribe capability and subscribe_event_types to policies for events. [GH-22474]
- Certificate Issuance External Policy Service (CIEPS): Allow highly-customizable operator control of certificate validation and generation through the PKI Secrets Engine.
- Agent auto-auth: support ldap auth [GH-21641]
- Seal High Availability Beta (enterprise): operators can try out configuring more than one automatic seal for resilience against seal provider outages. Not for production use at this time.
- Secrets Sync (enterprise): Add the ability to synchronize KVv2 secret with external secrets manager solutions.```
IMPROVEMENTS:
- Bump github.com/hashicorp/go-plugin version v1.4.9 -> v1.4.10 [GH-20966]
- api: add support for cloning a Client's tls.Config. [GH-21424]
- api: adding a new api sys method for replication status [GH-20995]
- audit: add core audit events experiment [GH-21628]
- auth/aws: Added support for signed GET requests for authenticating to vault using the aws iam method. [GH-10961]
- auth/cert: Adds support for requiring hexadecimal-encoded non-string certificate extension values [GH-21830]
- auth/ldap: improved login speed by adding concurrency to LDAP token group searches [GH-22659]
- auto-auth/azure: Added Azure Workload Identity Federation support to auto-auth (for Vault Agent and Vault Proxy). [GH-22264]
- aws/auth: Adds a new config field
use_sts_region_from_client
which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication. [GH-21960] - command/server: add
-dev-tls-san
flag to configure subject alternative names for the certificate generated when using-dev-tls
. [GH-22657] - core (ent) : Add field that allows lease-count namespace quotas to be inherited by child namespaces.
- core : Add field that allows rate-limit namespace quotas to be inherited by child namespaces. [GH-22452]
- core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
- core/quotas: Add configuration to allow skipping of expensive role calculations [GH-22651]
- core: Add a new periodic metric to track the number of available policies,
vault.policy.configured.count
. [GH-21010] - core: Fix OpenAPI representation and
-output-policy
recognition of some non-standard sudo paths [GH-21772] - core: Fix regexes for
sys/raw/
andsys/leases/lookup/
to match prevailing conventions [GH-21760] - core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [GH-22235]
- core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]
- core: add a listener configuration "chroot_namespace" that forces requests to use...
v1.14.3
1.14.3
September 13, 2023
SECURITY:
- secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]
CHANGES:
- core: Bump Go version to 1.20.8.
FEATURES:
- Merkle Tree Corruption Detection (enterprise): Add a new endpoint to check merkle tree corruption.
IMPROVEMENTS:
- auth/ldap: improved login speed by adding concurrency to LDAP token group searches [GH-22659]
- core/quotas: Add configuration to allow skipping of expensive role calculations [GH-22651]
- kmip (enterprise): reduce latency of KMIP operation handling
BUG FIXES:
- cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to
table
. [GH-22818] - core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [GH-22597]
- core/quotas: Reduce overhead for role calculation when using cloud auth methods. [GH-22583]
- core/seal: add a workaround for potential connection [hangs] in Azure autoseals. [GH-22760]
- core: All subloggers now reflect configured log level on reload. [GH-22038]
- kmip (enterprise): fix date handling error with some re-key operations
- raft/autopilot: Add dr-token flag for raft autopilot cli commands [GH-21165]
- replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
- secrets/transit: fix panic when providing non-PEM formatted public key for import [GH-22753]
- ui: fixes long namespace names overflow in the sidebar
v1.13.7
1.13.7
September 13, 2023
SECURITY:
- secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]
CHANGES:
- core: Bump Go version to 1.20.8.
- database/snowflake: Update plugin to v0.7.3 [GH-22591]
FEATURES:
- Merkle Tree Corruption Detection (enterprise): Add a new endpoint to check merkle tree corruption.
IMPROVEMENTS:
- auth/ldap: improved login speed by adding concurrency to LDAP token group searches [GH-22659]
- core/quotas: Add configuration to allow skipping of expensive role calculations [GH-22651]
- kmip (enterprise): reduce latency of KMIP operation handling
BUG FIXES:
- cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to
table
. [GH-22818] - core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [GH-22597]
- core/quotas: Reduce overhead for role calculation when using cloud auth methods. [GH-22583]
- core/seal: add a workaround for potential connection [hangs] in Azure autoseals. [GH-22760]
- core: All subloggers now reflect configured log level on reload. [GH-22038]
- kmip (enterprise): fix date handling error with some re-key operations
- raft/autopilot: Add dr-token flag for raft autopilot cli commands [GH-21165]
- replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
v1.12.11
1.12.11
September 13, 2023
SECURITY:
- secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]
IMPROVEMENTS:
- auth/ldap: improved login speed by adding concurrency to LDAP token group searches [GH-22659]
- kmip (enterprise): reduce latency of KMIP operation handling
BUG FIXES:
- cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to
table
. [GH-22818] - core/quotas: Reduce overhead for role calculation when using cloud auth methods. [GH-22583]
- core/seal: add a workaround for potential connection [hangs] in Azure autoseals. [GH-22760]
- raft/autopilot: Add dr-token flag for raft autopilot cli commands [GH-21165]
- replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
v1.14.2
August 30, 2023
CHANGES:
- auth/azure: Update plugin to v0.16.0 [GH-22277]
- core: Bump Go version to 1.20.7.
- database/snowflake: Update plugin to v0.9.0 [GH-22516]
IMPROVEMENTS:
- auto-auth/azure: Added Azure Workload Identity Federation support to auto-auth (for Vault Agent and Vault Proxy). [GH-22264]
- core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [GH-22235]
- kmip (enterprise): Add namespace lock and unlock support [GH-21925]
- replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
- secrets/database: Improves error logging for static role rotations by including the database and role names. [GH-22253]
- storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [GH-22040]
- ui: KV View Secret card will link to list view if input ends in "/" [GH-22502]
- ui: adds allowed_user_ids field to create role form and user_ids to generate certificates form in pki [GH-22191]
- ui: enables create and update KV secret workflow when control group present [GH-22471]
- website/docs: Fix link formatting in Vault lambda extension docs [GH-22396]
BUG FIXES:
- activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [GH-18809]
- agent: Environment variable VAULT_CACERT_BYTES now works for Vault Agent templates. [GH-22322]
- api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [GH-22523]
- core (enterprise): Remove MFA Configuration for namespace when deleting namespace
- core/metrics: vault.raft_storage.bolt.write.time should be a counter not a summary [GH-22468]
- core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
Also fix a related potential deadlock. [GH-21110] - core: Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [GH-22137]
- core: Fix bug where background thread to update locked user entries runs on DR secondaries. [GH-22355]
- core: Fix readonly errors that could occur while loading mounts/auths during unseal [GH-22362]
- core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [GH-21470]
- expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [GH-22374]
- license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [GH-22363]
- replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
- replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
- replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
- sdk/ldaputil: Properly escape user filters when using UPN domains
sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [GH-22249] - secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [GH-22330]
- secrets/transform (enterprise): Batch items with repeated tokens in the tokenization decode api will now contain the decoded_value element
- secrets/transform (enterprise): Fix nil panic when encoding a tokenization transformation on a non-active node
- secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
- storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [GH-20986]
- ui: Fix blank page or ghost secret when canceling KV secret create [GH-22541]
- ui: fixes
max_versions
default for secret metadata unintentionally overriding kv engine defaults [GH-22394] - ui: fixes model defaults overwriting input value when user tries to clear form input [GH-22458]
- ui: fixes text readability issue in revoke token confirmation dialog [GH-22390]
v1.13.6
August 30, 2023
CHANGES:
- core: Bump Go version to 1.20.7.
IMPROVEMENTS:
- core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [GH-22235]
- replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
- secrets/database: Improves error logging for static role rotations by including the database and role names. [GH-22253]
- storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [GH-22040]
- ui: KV View Secret card will link to list view if input ends in "/" [GH-22502]
- ui: enables create and update KV secret workflow when control group present [GH-22471]
BUG FIXES:
- activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [GH-18809]
- api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [GH-22523]
- core (enterprise): Remove MFA Configuration for namespace when deleting namespace
- core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
Also fix a related potential deadlock. [GH-21110] - core: Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [GH-22137]
- core: Fix bug where background thread to update locked user entries runs on DR secondaries. [GH-22355]
- core: Fix readonly errors that could occur while loading mounts/auths during unseal [GH-22362]
- core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [GH-21470]
- expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [GH-22374]
- license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [GH-22363]
- replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
- replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
- replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
- sdk/ldaputil: Properly escape user filters when using UPN domains
sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [GH-22249] - secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [GH-22331]
- secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
- ui: Fix blank page or ghost secret when canceling KV secret create [GH-22541]
- ui: fixes
max_versions
default for secret metadata unintentionally overriding kv engine defaults [GH-22394] - ui: fixes model defaults overwriting input value when user tries to clear form input [GH-22458]
v1.12.10
August 30, 2023
CHANGES:
- core: Bump Go version to 1.19.12.
IMPROVEMENTS:
- core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [GH-22235]
- replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
- storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [GH-22040]
- ui: enables create and update KV secret workflow when control group present [GH-22471]
BUG FIXES:
- api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [GH-22523]
- core (enterprise): Remove MFA Configuration for namespace when deleting namespace
- core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
Also fix a related potential deadlock. [GH-21110] - core: Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [GH-22137]
- core: Fix readonly errors that could occur while loading mounts/auths during unseal [GH-22362]
- core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [GH-21470]
- expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [GH-22374]
- license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [GH-22363]
- replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
- replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
- sdk/ldaputil: Properly escape user filters when using UPN domains
sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [GH-22249] - secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [GH-22332]
- secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
- ui: Fix blank page or ghost secret when canceling KV secret create [GH-22541]
- ui: fixes
max_versions
default for secret metadata unintentionally overriding kv engine defaults [GH-22394]
v1.14.1
July 25, 2023
CHANGES:
- auth/ldap: Normalize HTTP response codes when invalid credentials are provided [GH-21282]
- core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
which will have access to some system backend paths that were previously only accessible in the root namespace. [GH-21215] - secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
- storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [GH-20825]
IMPROVEMENTS:
- core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
- eventbus: updated go-eventlogger library to allow removal of nodes referenced by pipelines (used for subscriptions) [GH-21623]
- openapi: Better mount points for kv-v1 and kv-v2 in openapi.json [GH-21563]
- replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
- secrets/pki: Add a parameter to allow ExtKeyUsage field usage from a role within ACME. [GH-21702]
- secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
- sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [GH-21681]
BUG FIXES:
- agent: Fix "generate-config" command documentation URL [GH-21466]
- auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [GH-21800]
- auth/token, sys: Fix path-help being unavailable for some list-only endpoints [GH-18571]
- auth/token: Fix parsing of
auth/token/create
fields to avoid incorrect warnings about ignored parameters [GH-18556] - awsutil: Update awsutil to v0.2.3 to fix a regression where Vault no longer
respectsAWS_ROLE_ARN
,AWS_WEB_IDENTITY_TOKEN_FILE
, andAWS_ROLE_SESSION_NAME
. [GH-21951] - core/managed-keys (enterprise): Allow certain symmetric PKCS#11 managed key mechanisms (AES CBC with and without padding) to operate without an HMAC.
- core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [GH-24170]
- core: Fixed issue with some durations not being properly parsed to include days. [GH-21357]
- identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [GH-20965]
- openapi: Fix response schema for PKI Issue requests [GH-21449]
- openapi: Fix schema definitions for PKI EAB APIs [GH-21458]
- replication (enterprise): update primary cluster address after DR failover
- secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [GH-21631]
- secrets/pki: Fix bug with ACME tidy, 'unable to determine acme base folder path'. [GH-21870]
- secrets/pki: Fix preserving acme_account_safety_buffer on config/auto-tidy. [GH-21870]
- secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error:
no managed key found with uuid
. [GH-21316] - secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
- secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
- serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [GH-21642]
- ui: Adds missing values to details view after generating PKI certificate [GH-21635]
- ui: Fixed an issue where editing an SSH role would clear
default_critical_options
anddefault_extension
if left unchanged. [GH-21739] - ui: Fixed secrets, leases, and policies filter dropping focus after a single character [GH-21767]
- ui: Fixes issue with certain navigational links incorrectly displaying in child namespaces [GH-21562]
- ui: Fixes login screen display issue with Safari browser [GH-21582]
- ui: Fixes problem displaying certificates issued with unsupported signature algorithms (i.e. ed25519) [GH-21926]
- ui: Fixes styling of private key input when configuring an SSH key [GH-21531]
- ui: Surface DOMException error when browser settings prevent localStorage. [GH-21503]
v1.13.5
July 25, 2023
CHANGES:
- auth/ldap: Normalize HTTP response codes when invalid credentials are provided [GH-21282]
- core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
which will have access to some system backend paths that were previously only accessible in the root namespace. [GH-21215] - secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
IMPROVEMENTS:
- core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
- core: Add a new periodic metric to track the number of available policies,
vault.policy.configured.count
. [GH-21010] - replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
- secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
- sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [GH-21681]
BUG FIXES:
- auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [GH-21799]
- core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [GH-24170]
- identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [GH-20965]
- replication (enterprise): update primary cluster address after DR failover
- secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [GH-21632]
- secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error:
no managed key found with uuid
. [GH-21316] - secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [GH-20664]
- secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
- secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
- serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [GH-21642]
- ui: Fixed an issue where editing an SSH role would clear
default_critical_options
anddefault_extension
if left unchanged. [GH-21739] - ui: Surface DOMException error when browser settings prevent localStorage. [GH-21503]
v1.12.9
July 25, 2023
CHANGES:
- secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
IMPROVEMENTS:
- core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
- replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
- secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
BUG FIXES:
- core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [GH-24170]
- identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [GH-20965]
- replication (enterprise): update primary cluster address after DR failover
- secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [GH-21633]
- secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error:
no managed key found with uuid
. [GH-21316] - secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [GH-20664]
- secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
- secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
- serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [GH-21642]
- ui: Fixed an issue where editing an SSH role would clear
default_critical_options
anddefault_extension
if left unchanged. [GH-21739]