v1.16.1

1.16.1

April 04, 2024

Please note that Vault 1.16.1 is the first Enterprise release of the Vault Enterprise 1.16 series.

BUG FIXES:

• auth/ldap: Fix login error for group search anonymous bind. [GH-26200]
• auth/ldap: Fix login error missing entity alias attribute value. [GH-26200]
• cli: fixed a bug where the Vault CLI would error out if HOME was not set. [GH-26243]
• core: Only reload seal configuration when enable_multiseal is set to true. [GH-26166]
• secret/database: Fixed race condition where database mounts may leak connections [GH-26147]

v1.16.0

1.16.0

March 26, 2024

SECURITY:

• auth/cert: compare public keys of trusted non-CA certificates with incoming
  client certificates to prevent trusting certs with the same serial number
  but not the same public/private key. [GH-25649]
• auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request [GH-26091]
• secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]

CHANGES:

• Upgrade grpc to v1.58.3 [GH-23703]
• Upgrade x/net to v0.17.0 [GH-23703]
• api: add the enterprise parameter to the /sys/health endpoint [GH-24270]
• auth/alicloud: Update plugin to v0.16.1 [GH-25014]
• auth/alicloud: Update plugin to v0.17.0 [GH-25217]
• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• auth/azure: Update plugin to v0.16.1 [GH-22795]
• auth/azure: Update plugin to v0.17.0 [GH-25258]
• auth/cf: Update plugin to v0.16.0 [GH-25196]
• auth/gcp: Update plugin to v0.16.2 [GH-25233]
• auth/jwt: Update plugin to v0.19.0 [GH-24972]
• auth/jwt: Update plugin to v0.20.0 [GH-25326]
• auth/jwt: Update plugin to v0.20.1 [GH-25937]
• auth/kerberos: Update plugin to v0.10.1 [GH-22797]
• auth/kerberos: Update plugin to v0.11.0 [GH-25232]
• auth/kubernetes: Update plugin to v0.18.0 [GH-25207]
• auth/oci: Update plugin to v0.14.1 [GH-22774]
• auth/oci: Update plugin to v0.15.1 [GH-25245]
• cli: Using vault plugin reload with -plugin in the root namespace will now reload the plugin across all namespaces instead of just the root namespace. [GH-24878]
• cli: vault plugin info and vault plugin deregister now require 2 positional arguments instead of accepting either 1 or 2. [GH-24250]
• core (enterprise): Seal High Availability (HA) must be enabled by enable_multiseal in configuration.
• core: Bump Go version to 1.21.8.
• database/couchbase: Update plugin to v0.10.1 [GH-25275]
• database/elasticsearch: Update plugin to v0.14.0 [GH-25263]
• database/mongodbatlas: Update plugin to v0.11.0 [GH-25264]
• database/redis-elasticache: Update plugin to v0.3.0 [GH-25296]
• database/redis: Update plugin to v0.2.3 [GH-25289]
• database/snowflake: Update plugin to v0.10.0 [GH-25143]
• database/snowflake: Update plugin to v0.9.1 [GH-25020]
• events: Remove event noficiations websocket endpoint in non-Enterprise [GH-25640]
• events: Source URL is now vault://{vault node} [GH-24201]
• identity (enterprise): POST requests to the /identity/entity/merge endpoint
  are now always forwarded from standbys to the active node. [GH-24325]
• plugins/database: Reading connection config at database/config/:name will now return a computed running_plugin_version field if a non-builtin version is running. [GH-25105]
• plugins: Add a warning to the response from sys/plugins/reload/backend if no plugins were reloaded. [GH-24512]
• plugins: By default, environment variables provided during plugin registration will now take precedence over system environment variables.
  Use the environment variable VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true to opt out and keep higher preference for system environment
  variables. When this flag is set, Vault will check during unseal for conflicts and print warnings for any plugins with environment
  variables that conflict with system environment variables. [GH-25128]
• plugins: /sys/plugins/runtimes/catalog response will always include a list of "runtimes" in the response, even if empty. [GH-24864]
• sdk: Upgrade dependent packages by sdk.
  This includes github.com/docker/docker to v24.0.7+incompatible,
  google.golang.org/grpc to v1.57.2 and golang.org/x/net to v0.17.0. [GH-23913]
• secrets/ad: Update plugin to v0.16.2 [GH-25058]
• secrets/ad: Update plugin to v0.17.0 [GH-25187]
• secrets/alicloud: Update plugin to v0.16.0 [GH-25257]
• secrets/azure: Update plugin to v0.17.0 [GH-25189]
• secrets/gcp: Update plugin to v0.18.0 [GH-25173]
• secrets/gcpkms: Update plugin to v0.16.0 [GH-25231]
• secrets/keymgmt: Update plugin to v0.10.0
• secrets/kubernetes: Update plugin to v0.7.0 [GH-25204]
• secrets/kv: Update plugin to v0.16.2 [GH-22790]
• secrets/kv: Update plugin to v0.17.0 [GH-25277]
• secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]
• secrets/mongodbatlas: Update plugin to v0.11.0 [GH-25253]
• secrets/openldap: Update plugin to v0.11.3 [GH-25040]
• secrets/openldap: Update plugin to v0.12.0 [GH-25251]
• secrets/openldap: Update plugin to v0.12.1 [GH-25524]
• secrets/terraform: Update plugin to v0.7.5 [GH-25288]
• telemetry: Seal wrap encrypt/decrypt metrics now differentiate between seals using a metrics label of seal name rather than separate metric names. [GH-23837]
• ui: Update icons to use Flight icons where available. [GH-24823]
• ui: add subnav for replication items [GH-24283]

FEATURES:

• Add Snapshot Inspector Tool: Add CLI tool to inspect Vault snapshots [GH-23457]
• Audit Filtering: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log. [GH-24558]
• Controlled Access to Unauthenticated Endpoints (enterprise): Gives admins more control over how unauthenticated endpoints in Vault can be accessed and in some cases what information they return. [GH-23547] [GH-23534] [GH-23740]
• Custom messages (enterprise): Introduces custom messages settings, allowing users to view, and operators to configure system-wide messages.
• Database Event Notifications: The database plugin now emits event notifications. [GH-24718]
• Default Lease Count Quota (enterprise): Apply a new global default lease count quota of 300k leases for all
  new installs of Vault. [GH-24382]
• Experimental Raft-WAL Option: Reduces risk of infinite snapshot loops for follower nodes in large-scale Integrated Storage deployments. [GH-21460]
• Manual License Utilization Reporting: Added manual license
  utilization reporting, which allows users to create manual exports of product-license [metering
  data] to report to Hashicorp.
• Plugin Identity Tokens: Adds secret-less configuration of AWS secret engine using web identity federation. [GH-24987]
• Plugin Workload Identity (enterprise): Vault can generate identity tokens for plugins to use in workload identity federation auth flows.
• Quotas in Privileged Namespaces: Enable creation/update/deletion of quotas from the privileged namespace
• Reload seal configuration on SIGHUP: Seal configuration is reloaded on SIGHUP so that seal configuration can
  be changed without shutting down vault [GH-23571]
• Request Limiter (enterprise): Add adaptive concurrency lim...

v1.16.0-rc3

1.16.0-rc3

March 13, 2024

SECURITY:

• auth/cert: compare public keys of trusted non-CA certificates with incoming
  client certificates to prevent trusting certs with the same serial number
  but not the same public/private key. [GH-25649]
• secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]

CHANGES:

• Upgrade grpc to v1.58.3 [GH-23703]
• Upgrade x/net to v0.17.0 [GH-23703]
• api: add the enterprise parameter to the /sys/health endpoint [GH-24270]
• auth/alicloud: Update plugin to v0.16.1 [GH-25014]
• auth/alicloud: Update plugin to v0.17.0 [GH-25217]
• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• auth/azure: Update plugin to v0.16.1 [GH-22795]
• auth/azure: Update plugin to v0.17.0 [GH-25258]
• auth/cf: Update plugin to v0.16.0 [GH-25196]
• auth/gcp: Update plugin to v0.16.2 [GH-25233]
• auth/jwt: Update plugin to v0.19.0 [GH-24972]
• auth/jwt: Update plugin to v0.20.0 [GH-25326]
• auth/kerberos: Update plugin to v0.10.1 [GH-22797]
• auth/kerberos: Update plugin to v0.11.0 [GH-25232]
• auth/kubernetes: Update plugin to v0.18.0 [GH-25207]
• auth/oci: Update plugin to v0.14.1 [GH-22774]
• auth/oci: Update plugin to v0.15.1 [GH-25245]
• cli: Using vault plugin reload with -plugin in the root namespace will now reload the plugin across all namespaces instead of just the root namespace. [GH-24878]
• cli: vault plugin info and vault plugin deregister now require 2 positional arguments instead of accepting either 1 or 2. [GH-24250]
• core: Bump Go version to 1.21.8.
• database/couchbase: Update plugin to v0.10.1 [GH-25275]
• database/elasticsearch: Update plugin to v0.14.0 [GH-25263]
• database/mongodbatlas: Update plugin to v0.11.0 [GH-25264]
• database/redis-elasticache: Update plugin to v0.3.0 [GH-25296]
• database/redis: Update plugin to v0.2.3 [GH-25289]
• database/snowflake: Update plugin to v0.10.0 [GH-25143]
• database/snowflake: Update plugin to v0.9.1 [GH-25020]
• events: Remove event noficiations websocket endpoint in non-Enterprise [GH-25640]
• events: Source URL is now vault://{vault node} [GH-24201]
• identity (enterprise): POST requests to the /identity/entity/merge endpoint
  are now always forwarded from standbys to the active node. [GH-24325]
• plugins/database: Reading connection config at database/config/:name will now return a computed running_plugin_version field if a non-builtin version is running. [GH-25105]
• plugins: Add a warning to the response from sys/plugins/reload/backend if no plugins were reloaded. [GH-24512]
• plugins: By default, environment variables provided during plugin registration will now take precedence over system environment variables.
  Use the environment variable VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true to opt out and keep higher preference for system environment
  variables. When this flag is set, Vault will check during unseal for conflicts and print warnings for any plugins with environment
  variables that conflict with system environment variables. [GH-25128]
• plugins: /sys/plugins/runtimes/catalog response will always include a list of "runtimes" in the response, even if empty. [GH-24864]
• sdk: Upgrade dependent packages by sdk.
  This includes github.com/docker/docker to v24.0.7+incompatible,
  google.golang.org/grpc to v1.57.2 and golang.org/x/net to v0.17.0. [GH-23913]
• secrets/ad: Update plugin to v0.16.2 [GH-25058]
• secrets/ad: Update plugin to v0.17.0 [GH-25187]
• secrets/alicloud: Update plugin to v0.16.0 [GH-25257]
• secrets/azure: Update plugin to v0.17.0 [GH-25189]
• secrets/gcp: Update plugin to v0.18.0 [GH-25173]
• secrets/gcpkms: Update plugin to v0.16.0 [GH-25231]
• secrets/keymgmt: Update plugin to v0.10.0
• secrets/kubernetes: Update plugin to v0.7.0 [GH-25204]
• secrets/kv: Update plugin to v0.16.2 [GH-22790]
• secrets/kv: Update plugin to v0.17.0 [GH-25277]
• secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]
• secrets/mongodbatlas: Update plugin to v0.11.0 [GH-25253]
• secrets/openldap: Update plugin to v0.11.3 [GH-25040]
• secrets/openldap: Update plugin to v0.12.0 [GH-25251]
• secrets/openldap: Update plugin to v0.12.1 [GH-25524]
• secrets/terraform: Update plugin to v0.7.5 [GH-25288]
• telemetry: Seal wrap encrypt/decrypt metrics now differentiate between seals using a metrics label of seal name rather than separate metric names. [GH-23837]
• ui: Update icons to use Flight icons where available. [GH-24823]
• ui: add subnav for replication items [GH-24283]

FEATURES:

• Add Snapshot Inspector Tool: Add CLI tool to inspect Vault snapshots [GH-23457]
• Audit Filtering: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log. [GH-24558]
• Controlled Access to Unauthenticated Endpoints (enterprise): Gives admins more control over how unauthenticated endpoints in Vault can be accessed and in some cases what information they return. [GH-23547] [GH-23534] [GH-23740]
• Custom messages (enterprise): Introduces custom messages settings, allowing users to view, and operators to configure system-wide messages.
• Database Event Notifications: The database plugin now emits event notifications. [GH-24718]
• Default Lease Count Quota (enterprise): Apply a new global default lease count quota of 300k leases for all
  new installs of Vault. [GH-24382]
• Experimental Raft-WAL Option: Reduces risk of infinite snapshot loops for follower nodes in large-scale Integrated Storage deployments. [GH-21460]
• Manual License Utilization Reporting: Added manual license
  utilization reporting, which allows users to create manual exports of product-license [metering
  data] to report to Hashicorp.
• Plugin Identity Tokens: Adds secret-less configuration of AWS secret engine using web identity federation. [GH-24987]
• Plugin Workload Identity (enterprise): Vault can generate identity tokens for plugins to use in workload identity federation auth flows.
• Quotas in Privileged Namespaces: Enable creation/update/deletion of quotas from the privileged namespace
• Reload seal configuration on SIGHUP: Seal configuration is reloaded on SIGHUP so that seal configuration can
  be changed without shutting down vault [GH-23571]
• Request Limiter (enterprise): Add adaptive concurrency limits to
  write-based HTTP methods and special-case pki/issue requests to prevent
  overloading the Vault server. [GH-25093]
• Rotate Root for LDAP auth: Rotate root operations are now supported for the LDAP auth engine. [GH-24099]
• **Seal High Availability (...

v1.15.6

1.15.6

February 29, 2024

SECURITY:

• auth/cert: compare public keys of trusted non-CA certificates with incoming
  client certificates to prevent trusting certs with the same serial number
  but not the same public/private key. [GH-25649]

CHANGES:

• core: Bump Go version to 1.21.7.
• secrets/openldap: Update plugin to v0.12.1 [GH-25524]

FEATURES:

• Manual License Utilization Reporting: Added manual license
  utilization reporting, which allows users to create manual exports of product-license [metering
  data] to report to Hashicorp.

IMPROVEMENTS:

• auth/cert: Cache trusted certs to reduce memory usage and improve performance of logins. [GH-25421]
• ui: Add deletion_allowed param to transformations and include tokenization as a type option [GH-25436]
• ui: redirect back to current route after reauthentication when token expires [GH-25335]
• ui: remove unnecessary OpenAPI calls for unmanaged auth methods [GH-25364]

BUG FIXES:

• agent: Fix issue where Vault Agent was unable to render KVv2 secrets with delete_version_after set. [GH-25387]
• audit: Handle a potential panic while formatting audit entries for an audit log [GH-25605]
• core (enterprise): Fix a deadlock that can occur on performance secondary clusters when there are many mounts and a mount is deleted or filtered [GH-25448]
• core (enterprise): Fix a panic that can occur if only one seal exists but is unhealthy on the non-first restart of Vault.
• core/quotas: Deleting a namespace that contains a rate limit quota no longer breaks replication [GH-25439]
• openapi: Fixing response fields for rekey operations [GH-25509]
• secrets/transit: When provided an invalid input with hash_algorithm=none, a lock was not released properly before reporting an error leading to deadlocks on a subsequent key configuration update. [GH-25336]
• storage/file: Fixing spuriously deleting storage keys ending with .temp [GH-25395]
• transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
• ui: Do not disable JSON display toggle for KV version 2 secrets [GH-25235]
• ui: Do not show resultant-acl banner on namespaces a user has access to [GH-25256]
• ui: Fix copy button not working on masked input when value is not a string [GH-25269]
• ui: Update the KV secret data when you change the version you're viewing of a nested secret. [GH-25152]

v1.14.10

1.14.10

February 29, 2024

SECURITY:

• auth/cert: compare public keys of trusted non-CA certificates with incoming
  client certificates to prevent trusting certs with the same serial number
  but not the same public/private key. [GH-25649]

CHANGES:

• core: Bump Go version to 1.20.14.

FEATURES:

• Manual License Utilization Reporting: Added manual license
  utilization reporting, which allows users to create manual exports of product-license [metering
  data] to report to Hashicorp.

IMPROVEMENTS:

• auth/cert: Cache trusted certs to reduce memory usage and improve performance of logins. [GH-25421]
• ui: redirect back to current route after reauthentication when token expires [GH-25335]
• ui: remove unnecessary OpenAPI calls for unmanaged auth methods [GH-25364]

BUG FIXES:

• core (enterprise): Fix a deadlock that can occur on performance secondary clusters when there are many mounts and a mount is deleted or filtered [GH-25448]
• core/quotas: Deleting a namespace that contains a rate limit quota no longer breaks replication [GH-25439]
• secrets/transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
• secrets/transit: When provided an invalid input with hash_algorithm=none, a lock was not released properly before reporting an error leading to deadlocks on a subsequent key configuration update. [GH-25336]
• storage/file: Fixing spuriously deleting storage keys ending with .temp [GH-25395]

v1.16.0-rc2

1.16.0-rc2

February 21, 2024

SECURITY:

• secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]

CHANGES:

• Upgrade grpc to v1.58.3 [GH-23703]
• Upgrade x/net to v0.17.0 [GH-23703]
• api: add the enterprise parameter to the /sys/health endpoint [GH-24270]
• auth/alicloud: Update plugin to v0.17.0 [GH-25217]
• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• auth/azure: Update plugin to v0.17.0 [GH-25258]
• auth/cf: Update plugin to v0.16.0 [GH-25196]
• auth/gcp: Update plugin to v0.16.2 [GH-25233]
• auth/jwt: Update plugin to v0.20.0 [GH-25326]
• auth/kerberos: Update plugin to v0.11.0 [GH-25232]
• auth/kubernetes: Update plugin to v0.18.0 [GH-25207]
• auth/oci: Update plugin to v0.15.1 [GH-25245]
• cli: Using vault plugin reload with -plugin in the root namespace will now reload the plugin across all namespaces instead of just the root namespace. [GH-24878]
• cli: vault plugin info and vault plugin deregister now require 2 positional arguments instead of accepting either 1 or 2. [GH-24250]
• core: Bump Go version to 1.21.5.
• database/couchbase: Update plugin to v0.10.1 [GH-25275]
• database/elasticsearch: Update plugin to v0.14.0 [GH-25263]
• database/mongodbatlas: Update plugin to v0.11.0 [GH-25264]
• database/redis-elasticache: Update plugin to v0.3.0 [GH-25296]
• database/redis: Update plugin to v0.2.3 [GH-25289]
• database/snowflake: Update plugin to v0.10.0 [GH-25143]
• events: Source URL is now vault://{vault node} [GH-24201]
• identity (enterprise): POST requests to the /identity/entity/merge endpoint
  are now always forwarded from standbys to the active node. [GH-24325]
• plugins/database: Reading connection config at database/config/:name will now return a computed running_plugin_version field if a non-builtin version is running. [GH-25105]
• plugins: Add a warning to the response from sys/plugins/reload/backend if no plugins were reloaded. [GH-24512]
• plugins: By default, environment variables provided during plugin registration will now take precedence over system environment variables. Use the environment variable VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true to opt out and keep higher preference for system environment variables. When this flag is set, Vault will check during unseal for conflicts and print warnings for any plugins with environment variables that conflict with system environment variables. [GH-25128]
• plugins: /sys/plugins/runtimes/catalog response will always include a list of "runtimes" in the response, even if empty. [GH-24864]
• sdk: Upgrade dependent packages by sdk. This includes github.com/docker/docker to v24.0.7+incompatible,
  google.golang.org/grpc to v1.57.2 and golang.org/x/net to v0.17.0. [GH-23913]
• secrets/ad: Update plugin to v0.17.0 [GH-25187]
• secrets/alicloud: Update plugin to v0.16.0 [GH-25257]
• secrets/azure: Update plugin to v0.17.0 [GH-25189]
• secrets/gcp: Update plugin to v0.18.0 [GH-25173]
• secrets/gcpkms: Update plugin to v0.16.0 [GH-25231]
• secrets/keymgmt: Update plugin to v0.10.0
• secrets/kubernetes: Update plugin to v0.7.0 [GH-25204]
• secrets/kv: Update plugin to v0.17.0 [GH-25277]
• secrets/mongodbatlas: Update plugin to v0.11.0 [GH-25253]
• secrets/openldap: Update plugin to v0.11.3 [GH-25040]
• secrets/openldap: Update plugin to v0.12.0 [GH-25251]
• secrets/openldap: Update plugin to v0.12.1 [GH-25524]
• secrets/terraform: Update plugin to v0.7.5 [GH-25288]
• telemetry: Seal wrap encrypt/decrypt metrics now differentiate between seals using a metrics label of seal name rather than separate metric names. [GH-23837]
• ui: Update icons to use Flight icons where available. [GH-24823]
• ui: add subnav for replication items [GH-24283]

FEATURES:

• Audit Filtering: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log. [GH-24558]
• Custom Messages: Introduces custom messages settings, allowing users to view, and operators to configure system-wide messages. [GH-23945]
• Database Event Notifications: The database plugin now emits event notifications. [GH-24718]
• Default Lease Count Quota: Apply a new global default lease count quota of 300k leases for all
  new installs of Vault. [GH-24382]
• Manual License Utilization Reporting: Added manual license
  utilization reporting, which allows users to create manual exports of product-license [metering
  data] to report to Hashicorp.
• Plugin Identity Tokens: Adds secret-less configuration of AWS secret engine using web identity federation. [GH-24987]
• Plugin Workload Identity: Vault can generate identity tokens for plugins to use in workload identity federation auth flows. [GH-25219]
• Quotas in Privileged Namespaces: Enable creation/update/deletion of quotas from the privileged namespace [GH-24040]
• Quotas in Privileged Namespaces: Enable creation/update/deletion of quotas from the privileged namespace
• Reload seal configuration on SIGHUP: Seal configuration is reloaded on SIGHUP so that seal configuration can
  be changed without shutting down vault [GH-23571]
• Request Limiter: Add adaptive concurrency limits to write-based HTTP
  methods and special-case pki/issue requests to prevent overloading the Vault
  server. [GH-25093]
• Rotate Root for LDAP auth: Rotate root operations are now supported for the LDAP auth engine. [GH-24099]
• Seal High Availability (enterprise): Operators can configure more than one automatic seal for resilience against seal provider outages.
• Secrets Sync UI (enterprise): Adds secret syncing for KV v2 secrets to external destinations using the UI. [GH-23667]
• Vault PKI EST Server (Enterprise/Beta): Beta support for the PKI Enrollment over Secure Transport (EST) certificate management protocol has been added to the Vault PKI Plugin. This allows standard EST clients to request certificates from a Vault server with no knowledge of Vault APIs.
• Vault Proxy Static Secret Caching: Adds support for static secret (KVv1 and KVv2) caching to Vault Proxy. [GH-23621]
• raft-wal: Add experimental support for raft-wal, a new backend engine for integrated storage. [GH-21460]
• secrets-import (enterprise): Support importing secrets from external sources into KVv2
• secrets/aws: Support issuing an STS Session Token directly from the root credential. [GH-23690]
• cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]
• cli: introduce new command group hcp which groups subcommands for authentication of users or machines to HCP using
  either provided arguments or retrieved HCP token through browser login. [GH-23897]
• config/listener: allow per-listener configuration setting to disable replication status endpoints. [GH-23547]
• config/listener: allow per-listener configuration settings to redact sensitive pa...

v1.16.0-rc1

1.16.0-rc1

February 14, 2024

SECURITY:

• secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [GH-22852]

CHANGES:

• Upgrade grpc to v1.58.3 [GH-23703]
• Upgrade x/net to v0.17.0 [GH-23703]
• api: add the enterprise parameter to the /sys/health endpoint [GH-24270]
• auth/alicloud: Update plugin to v0.17.0 [GH-25217]
• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• auth/azure: Update plugin to v0.17.0 [GH-25258]
• auth/cf: Update plugin to v0.16.0 [GH-25196]
• auth/gcp: Update plugin to v0.16.2 [GH-25233]
• auth/jwt: Update plugin to v0.20.0 [GH-25326]
• auth/kerberos: Update plugin to v0.11.0 [GH-25232]
• auth/kubernetes: Update plugin to v0.18.0 [GH-25207]
• auth/oci: Update plugin to v0.15.1 [GH-25245]
• cli: Using vault plugin reload with -plugin in the root namespace will now reload the plugin across all namespaces instead of just the root namespace. [GH-24878]
• cli: vault plugin info and vault plugin deregister now require 2 positional arguments instead of accepting either 1 or 2. [GH-24250]
• core: Bump Go version to 1.21.5.
• database/couchbase: Update plugin to v0.10.1 [GH-25275]
• database/elasticsearch: Update plugin to v0.14.0 [GH-25263]
• database/mongodbatlas: Update plugin to v0.11.0 [GH-25264]
• database/redis-elasticache: Update plugin to v0.3.0 [GH-25296]
• database/redis: Update plugin to v0.2.3 [GH-25289]
• database/snowflake: Update plugin to v0.10.0 [GH-25143]
• events: Source URL is now vault://{vault node} [GH-24201]
• identity (enterprise): POST requests to the /identity/entity/merge endpoint
  are now always forwarded from standbys to the active node. [GH-24325]
• plugins/database: Reading connection config at database/config/:name will now return a computed running_plugin_version field if a non-builtin version is running. [GH-25105]
• plugins: Add a warning to the response from sys/plugins/reload/backend if no plugins were reloaded. [GH-24512]
• plugins: By default, environment variables provided during plugin registration will now take precedence over system environment variables.
  Use the environment variable VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true to opt out and keep higher preference for system environment
  variables. When this flag is set, Vault will check during unseal for conflicts and print warnings for any plugins with environment
  variables that conflict with system environment variables. [GH-25128]
• plugins: /sys/plugins/runtimes/catalog response will always include a list of "runtimes" in the response, even if empty. [GH-24864]
• sdk: Upgrade dependent packages by sdk.
  This includes github.com/docker/docker to v24.0.7+incompatible,
  google.golang.org/grpc to v1.57.2 and golang.org/x/net to v0.17.0. [GH-23913]
• secrets/ad: Update plugin to v0.17.0 [GH-25187]
• secrets/alicloud: Update plugin to v0.16.0 [GH-25257]
• secrets/azure: Update plugin to v0.17.0 [GH-25189]
• secrets/gcp: Update plugin to v0.18.0 [GH-25173]
• secrets/gcpkms: Update plugin to v0.16.0 [GH-25231]
• secrets/keymgmt: Update plugin to v0.10.0
• secrets/kubernetes: Update plugin to v0.7.0 [GH-25204]
• secrets/kv: Update plugin to v0.17.0 [GH-25277]
• secrets/mongodbatlas: Update plugin to v0.11.0 [GH-25253]
• secrets/openldap: Update plugin to v0.12.0 [GH-25251]
• secrets/terraform: Update plugin to v0.7.5 [GH-25288]
• telemetry: Seal wrap encrypt/decrypt metrics now differentiate between seals using a metrics label of seal name rather than separate metric names. [GH-23837]
• ui: Update icons to use Flight icons where available. [GH-24823]
• ui: add subnav for replication items [GH-24283]

FEATURES:

• Audit Filtering: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log. [GH-24558]
• Custom messages: Introduces custom messages settings, allowing users to view, and operators to configure system-wide messages. [GH-23945]
• Database Event Notifications: The database plugin now emits event notifications. [GH-24718]
• Default Lease Count Quota: Apply a new global default lease count quota of 300k leases for all
  new installs of Vault. [GH-24382]
• Manual License Utilization Reporting: Added manual license
  utilization reporting, which allows users to create manual exports of product-license [metering
  data] to report to Hashicorp.
• Plugin Identity Tokens: Adds secret-less configuration of AWS secret engine using web identity federation. [GH-24987]
• Plugin Workload Identity: Vault can generate identity tokens for plugins to use in workload identity federation auth flows. [GH-25219]
• Quotas in Privileged Namespaces: Enable creation/update/deletion of quotas from the privileged namespace [GH-24040]
• Reload seal configuration on SIGHUP: Seal configuration is reloaded on SIGHUP so that seal configuration can
  be changed without shutting down vault [GH-23571]
• Request Limiter: Add adaptive concurrency limits to write-based HTTP
  methods and special-case pki/issue requests to prevent overloading the Vault
  server. [GH-25093]
• Rotate Root for LDAP auth: Rotate root operations are now supported for the LDAP auth engine. [GH-24099]
• Seal High Availability (enterprise): Operators can configure more than one automatic seal for resilience against seal provider outages.
• Secrets Sync UI (enterprise): Adds secret syncing for KV v2 secrets to external destinations using the UI. [GH-23667]
• Vault PKI EST Server (Enterprise/Beta): Beta support for the PKI Enrollment over Secure Transport (EST) certificate management protocol has been added to the Vault PKI Plugin. This allows standard EST clients to request certificates from a Vault server with no knowledge of Vault APIs.
• Vault Proxy Static Secret Caching: Adds support for static secret (KVv1 and KVv2) caching to Vault Proxy. [GH-23621]
• raft-wal: Add experimental support for raft-wal, a new backend engine for integrated storage. [GH-21460]
• secrets-import (enterprise): Support importing secrets from external sources into KVv2
• secrets/aws: Support issuing an STS Session Token directly from the root credential. [GH-23690]
• cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]
• cli: introduce new command group hcp which groups subcommands for authentication of users or machines to HCP using
  either provided arguments or retrieved HCP token through browser login. [GH-23897]
• config/listener: allow per-listener configuration setting to disable replication status endpoints. [GH-23547]
• config/listener: allow per-listener configuration settings to redact sensitive parts of response to unauthenticated endpoints. [GH-23534]
• core: add sys/internal/ui/version endpoint [GH-23740]
• sys (enterprise): Enable sys/config/group-application-policy in privileged namespace

IMPROVE...

v1.14.9

1.14.9

January 31, 2024

CHANGES:

• core: Bump Go version to 1.20.12.
• database/snowflake: Update plugin to v0.9.2 [GH-25057]

IMPROVEMENTS:

• command/server: display logs on startup immediately if disable-gated-logs flag is set [GH-24280]
• oidc/provider: Adds code_challenge_methods_supported to OpenID Connect Metadata [GH-24979]
• storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [GH-24010]
• ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [GH-18513]

BUG FIXES:

• helper/pkcs7: Fix slice out-of-bounds panic [GH-24891]
• kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
• ui: Fixed minor bugs with database secrets engine [GH-24947]
• ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [GH-24697]
• ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [GH-24660]
• ui: fix incorrectly calculated capabilities on PKI issuer endpoints [GH-24686]

v1.13.13

1.13.13

January 31, 2024

CHANGES:

• core: Bump Go version to 1.20.12.
• database/snowflake: Update plugin to v0.7.4 [GH-25059]

IMPROVEMENTS:

• command/server: display logs on startup immediately if disable-gated-logs flag is set [GH-24280]
• storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [GH-24010]
• ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [GH-18513]

BUG FIXES:

• helper/pkcs7: Fix slice out-of-bounds panic [GH-24891]
• kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
• ui: Fixed minor bugs with database secrets engine [GH-24947]
• ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [GH-24697]
• ui: fix incorrectly calculated capabilities on PKI issuer endpoints [GH-24686]

v1.15.5

1.15.5

January 31, 2024

SECURITY:

• audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [GH-24968] [HCSEC-2024-01]

CHANGES:

• core: Bump Go version to 1.21.5.
• database/snowflake: Update plugin to v0.9.1 [GH-25020]
• secrets/ad: Update plugin to v0.16.2 [GH-25058]
• secrets/openldap: Update plugin to v0.11.3 [GH-25040]

IMPROVEMENTS:

• command/server: display logs on startup immediately if disable-gated-logs flag is set [GH-24280]
• core/activity: Include secret_syncs in activity log responses [GH-24710]
• oidc/provider: Adds code_challenge_methods_supported to OpenID Connect Metadata [GH-24979]
• storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [GH-24010]
• sys (enterprise): Adds the chroot_namespace field to this sys/internal/ui/resultant-acl endpoint, which exposes the value of the chroot namespace from the
  listener config.
• ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [GH-18513]

BUG FIXES:

• audit/socket: Provide socket based audit backends with 'prefix' configuration option when supplied. [GH-25004]
• audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [GH-24968]
• auth/saml (enterprise): Fixes support for Microsoft Entra ID enterprise applications
• core (enterprise): fix a potential deadlock if an error is received twice from underlying storage for the same key
• core: upgrade github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 to
  support azure workload identities. [GH-24954]
• helper/pkcs7: Fix slice out-of-bounds panic [GH-24891]
• kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
• plugins: fix panic when registering containerized plugin with a custom runtime on a perf standby
• ui: Allows users to dismiss the resultant-acl banner. [GH-25106]
• ui: Correctly handle redirects from pre 1.15.0 Kv v2 edit, create, and show urls. [GH-24339]
• ui: Fixed minor bugs with database secrets engine [GH-24947]
• ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [GH-24697]
• ui: Fixes policy input toolbar scrolling by default [GH-23297]
• ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [GH-24660]
• ui: fix KV v2 details view defaulting to JSON view when secret value includes { [GH-24513]
• ui: fix incorrectly calculated capabilities on PKI issuer endpoints [GH-24686]
• ui: fix issue where kv v2 capabilities checks were not passing in the full secret path if secret was inside a directory. [GH-24404]
• ui: fix navigation items shown to user when chroot_namespace configured [GH-24492]