🔧 Renovate: Update (minor) regex/hashicorp/vault to 1.20.4 to v1.20.4 - autoclosed #36
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Trez/lunafreya-lva#36
Reference in New Issue
Block a user
Delete Branch "renovate/regex-hashicorp-vault-1-20-4"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.18.5->1.20.41.20.0->1.20.4⚡ Renovate Update Info
Update Type: minor
Automerge: 🛑 This update requires manual approval
Update Type: patch
Release Notes
hashicorp/vault (hashicorp/vault)
v1.20.4Compare Source
September 24, 2025
SECURITY:
CHANGES:
IMPROVEMENTS:
x_forwarded_for_client_cert_header, to fix TLS certificate auth errors with Google Cloud Application Load Balancer. [GH-31501]BUG FIXES:
v1.20.3Compare Source
August 28, 2025
FEATURES:
SECURITY:
CHANGES:
max_json_depth,max_json_string_value_length,max_json_object_entry_count,max_json_array_element_count. [GH-31069]IMPROVEMENTS:
BUG FIXES:
keyring when not all seals are healthy. This prevents the possibility of
failing to unseal when a different subset of seals are healthy than were
healthy at last write. (bbe64227)
standby node in a PR secondary cluster.
rotation_statementsfield. [GH-31442]v1.20.2Compare Source
August 06, 2025
SECURITY:
BUG FIXES:
v1.20.1Compare Source
July 25, 2025
SECURITY:
FEATURES:
IMPROVEMENTS:
-downloadoption for plugin register (beta)BUG FIXES:
development_clustersetting being overwritten on performance secondaries upon cluster reload. [GH-31223]sys/internal/ui/mountsso mount paths match serve value [GH-31094]v1.20.0Compare Source
June 25, 2025
SECURITY:
CHANGES:
start_timeandend_timeinsys/internal/counters/activityare aligned to the corresponding billing period.end_timeinsys/internal/counters/activityis now capped at the end of the last completed month. [GH-30164]Retry-Afterheader and, if it exists, wait for the specified duration before retrying the request. [GH-30887]resource_group_name,vm_name, andvmss_nameto match token claims [GH-30052]Retry-Aftervalue to the nearest second when calculating the retry delay. [GH-30887]client count data by
namespace,mount_path,mount_typeor number of clients fora selected month. [GH-30678]
FormErrorcomponent (not used) [GH-34699]/vault/auth?with=query parameter [GH-30500]/vault/auth?with=query parameter now exclusively refers to the auth mount path and renders a simplified form [GH-30500]FEATURES:
remove_irrevocable_lease_after. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [GH-30703]development_clusteras a field to Vault's utilization reports.The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [GH-30659]
group_byfield to the rate limit quota API to support different grouping modes.snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot. [GH-30739]
IMPROVEMENTS:
/sys/utilization-report, giving a snapshot overview of Vault's utilization at a high level.vault.core.response_status_code, with two labels,code, andtype, detailing the status codes of all responses to requests that Vault handles. [GH-30354]vault_indexto an event's metadata if the metadata containsmodified=true, to support client consistency controls when reading from Vault in response to an event where storage was modified. [GH-30725]VAULT_MYSQL_USERNAMEandVAULT_MYSQL_PASSWORD. [GH-30136]listing_visibility="unauth"; all methods can be accessed via the "Sign in with other methods" link [GH-30500]DEPRECATIONS:
/sys/internal/counters/tokensendpoint. Attempting to call this endpoint will return a 403 "unsupported path" exception. [GH-30561]BUG FIXES:
core/managed-keys (enterprise): fix RSA encryption/decryption with OAEP on managed keys.
conflicting local aliases. [GH-30390]
when it becomes active because standby nodes don't extract the artifact when the plugin
is registered. Remove extracting from Vault and require the operator to place
the extracted artifact in the plugin directory before registration.
plugin_tmpdirconfig [GH-29978]plugin_tmpdirconfigauto_joinconfigurations that include escape characters [GH-29874]NextVaultRotationis nil.Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing
NextVaultRotationvalue.Now sets it to either
LastVaultRotation + RotationPeriodornow + RotationPeriod. [GH-30265]intermediate certificates. [GH-30034]
private_keyafter generating [GH-30778]configblock [GH-30960]v1.19.5Compare Source
May 30, 2025
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
CHANGES:
IMPROVEMENTS:
BUG FIXES:
v1.19.4Compare Source
May 16, 2025
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
CHANGES:
IMPROVEMENTS:
BUG FIXES:
when it becomes active because standby nodes don't extract the artifact when the plugin
is registered. Remove extracting from Vault and require the operator to place
the extracted artifact in the plugin directory before registration.
v1.19.3Compare Source
April 30, 2025
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
SECURITY:
CHANGES:
BUG FIXES:
plugin_tmpdirconfig [GH-29978]v1.19.2Compare Source
April 18, 2025
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
CHANGES:
BUG FIXES:
NextVaultRotationis nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missingNextVaultRotationvalue. Now sets it to eitherLastVaultRotation + RotationPeriodornow + RotationPeriod. [GH-30265]v1.19.1Compare Source
September 24, 2025
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
SECURITY:
CHANGES:
IMPROVEMENTS:
x_forwarded_for_client_cert_header, to fix TLS certificate auth errors with Google Cloud Application Load Balancer.BUG FIXES:
ed25519keys that were imported with derivation enabledv1.19.0Compare Source
March 5, 2025
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
SECURITY:
CHANGES:
removedcodequery parameter. [GH-28991]haunhealthycodequery parameter. [GH-28991]10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
the maximum of 16s. This should make unsealing of the node faster in some cases.
to not have to pass every required field on each write and to make individual updates as necessary.
Note: in order to zero out a value that is previously configured, users must now explicitly set the
field to its zero value on an update. [GH-29497]
FEATURES:
plugins. This allows plugin users to automate their root credential rotations based on configurable
schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29497]
This allows plugin users to automate their root credential rotations based on configurable
schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29557]
This allows plugin users to automate their root credential rotations based on configurable
schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29591]
This allows plugin users to automate their root credential rotations based on configurable
schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29598]
Entities and Groups by renaming them. This feature is disabled by default and
can be enabled through the
force_identity_deduplicationactivation flag. [GH-29356]plugin users to automate their root credential rotations based on configurable schedules/periods.
IMPROVEMENTS:
HMAC'ed by default but can be configured to be via the
/sys/config/auditing/request-headers/user-agentendpoint. [GH-28596]enable_metadata_on_failuresto add client cert metadata on login failures to audit log and response [GH-29044]enable_reauth_on_new_credentialsis enabled. [GH-28126]enable_reauth_on_new_credentials, supporting re-authentication when receiving new credential on certain auto-auth types [GH-28126]pprof-dump-dir[GH-27033]removed_from_clusterfield to sys/seal-status and vault status output to indicate whether the node has been removed from the HA cluster. [GH-28938]enable_post_unseal_traceandpost_unseal_trace_directoryconfig options to generate Go traces during the post-unseal step for debug purposes. [GH-28895]/sys/config/state/sanitizedoutput. [GH-29485]pathevent metadata field when authorizing a client'ssubscribecapability for consuming an event, instead of requiringdata_pathto be present in the event metadata.duplicate identify resources in storage. [GH-29325]
RSA key generation when using slow random sources, speeding key generation
considerably. [GH-29020]
always_enforce_errwithinleaf_not_after_behaviorto force the error in all circumstances such as CA issuance and ACME requests if requested TTL values are beyond the issuer's NotAfter. [GH-28907]serial_number_sourceoption to PKI roles to control the source for the subject serial number. [GH-29369]BUG FIXES:
when
template_configis set in one of the config files. [GH-29680]inconsistently during different unseal events or on different servers. [GH-28867]
in addition to the existing check for leading slashes. [GH-28878]
seal unwrapper was performing the read twice, and would also issue an unnecessary storage write. [GH-29050]
The Cache-Control header returned by the identity/oidc/.well-known/keys endpoint now depends only on the named keys for
the queried namespace. [GH-29312]
Unblocks customers that were stuck in a failing loop when attempting to rotate static role passwords. [GH-28989]
to be set to false. [GH-28832]
Unblocks customers that were stuck in a failing loop when attempting to rotate static role passwords. [GH-29131]
allow_empty_principalsin the read role api when key_type is "ca" [GH-28901]connection_urlto fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables. [GH-29114]Configuration
📅 Schedule: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Renovate Bot.
🔧 Renovate: Update (minor) regex/hashicorp/vault to 1.20.4 to v1.20.4to 🔧 Renovate: Update (minor) regex/hashicorp/vault to 1.20.4 to v1.20.4 - autoclosedPull request closed