v1.19.5

1.19.5

May 30, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

CHANGES:

• database/snowflake: Update plugin to v0.13.1 [GH-30775]

IMPROVEMENTS:

• plugins: Support registration of CE plugins with extracted artifact directory. [GH-30673]

BUG FIXES:

• ui: Fix broken link to Hashicorp Vault developer site in the Web REPL help. [GH-30670]

v1.19.4

1.19.4

May 16, 2025

CHANGES:

• Update vault-plugin-auth-cf to v0.20.1 [GH-30586]
• auth/azure: Update plugin to v0.20.4 [GH-30543]
• core: Bump Go version to 1.24.3.

IMPROVEMENTS:

• Namespaces (enterprise): allow a root token to relock a namespace
• core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
• core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [GH-30576]
• core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [GH-30603]
• ui: Replaces all instances of the deprecated event.keyCode with event.key [GH-30493]

BUG FIXES:

• core (enterprise): fix a bug where plugin automated root rotations would stop after seal/unseal operations
• plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
  when it becomes active because standby nodes don't extract the artifact when the plugin
  is registered. Remove extracting from Vault and require the operator to place
  the extracted artifact in the plugin directory before registration.

v1.19.3

1.19.3

April 30, 2025

CHANGES:

• auth/jwt: Update plugin to v0.23.2 [GH-30434]

BUG FIXES:

• core (enterprise): fix issue with errors being swallowed on failed HSM logins.
• database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [GH-30320]
• database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [GH-30327]
• identity: Fix non-deterministic merge behavior when two entities have conflicting local aliases. [GH-30390]
• plugins: plugin registration should honor the plugin_tmpdir config [GH-29978]
• secrets/aws: fix a case where GovCloud wasn't taken into account; fix a case where the region setting wasn't respected [GH-30312]

v1.19.2

1.19.2

April 18, 2025

CHANGES:

• core: Bump Go version to 1.23.7
• core: Bump Go version to 1.23.8
• secrets/openldap: Update plugin to v0.15.4 [GH-30279]

BUG FIXES:

• secrets/openldap: Prevent static role rotation on upgrade when NextVaultRotation is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value. Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]
• secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
• secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain intermediate certificates. [GH-30034]
• secrets/transit: fix a panic when rotating on a managed key returns an error [GH-30214]

v1.19.1

1.19.1

April 4, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

CHANGES:

• UI: remove outdated and unneeded js string extensions [GH-29834]
• auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
• auth/azure: Update plugin to v0.20.3 [GH-30082]
• auth/gcp: Update plugin to v0.20.2 [GH-30081]
• core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [GH-29774]
• secrets/azure: Update plugin to v0.21.2 [GH-30037]
• secrets/azure: Update plugin to v0.21.3 [GH-30083]
• secrets/gcp: Update plugin to v0.21.2 [GH-29970]
• secrets/gcp: Update plugin to v0.21.3 [GH-30080]
• secrets/openldap: Update plugin to v0.15.2 [GH-30079]

IMPROVEMENTS:

• activity: mount_type was added to the API response of sys/internal/counters/activity [GH-30071]
• activity: mount_type was added to the API response of sys/internal/counters/activity
• core (enterprise): report errors from the underlying seal when getting entropy.
• storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [GH-29976]

BUG FIXES:

• auth/aws: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [GH-29922]
• auth/ldap: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set [GH-29996]
• core (enterprise): add nil check before attempting to use Rotation Manager operations.
• core: Fix a bug that prevents certain loggers from writing to a log file. [GH-29917]
• identity: reintroduce RPC functionality for group creates, allowing performance standbys to handle external group changes during login and token renewal [GH-30069]
• plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
• secrets/aws: fix a bug where environment and shared credential providers were overriding the WIF configuration [GH-29982]
• secrets/aws: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• secrets/db: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store. [GH-29852]

v1.19.0

1.19.0

March 5, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

SECURITY:

• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0

CHANGES:

• agent/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29517]
• api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the removedcode query parameter. [GH-28991]
• api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the haunhealthycode query parameter. [GH-28991]
• auth/alicloud: Update plugin to v0.20.0 [GH-29613]
• auth/azure: Update plugin to v0.19.1 [GH-28712]
• auth/azure: Update plugin to v0.19.2 [GH-28848]
• auth/azure: Update plugin to v0.20.0 [GH-29606]
• auth/azure: Update plugin to v0.20.1 [GH-29728]
• auth/cf: Update plugin to v0.19.1 [GH-29295]
• auth/cf: Update plugin to v0.20.0 [GH-29528]
• auth/gcp: Update plugin to v0.20.0 [GH-29591]
• auth/gcp: Update plugin to v0.20.1 [GH-29736]
• auth/jwt: Update plugin to v0.23.0 [GH-29553]
• auth/kerberos: Update plugin to v0.14.0 [GH-29617]
• auth/kubernetes: Update plugin to v0.21.0 [GH-29619]
• auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. [GH-29302]
• auth/ldap: No longer return authentication warnings to client. [GH-29134]
• auth/oci: Update plugin to v0.18.0 [GH-29620]
• core (enterprise): Add tracking of performance standbys by their HA node ID so that RPC connections can be more easily cleaned up when nodes are removed. [GH-29303]
• core/ha (enterprise): Failed attempts to become a performance standby node are now using an exponential backoff instead of a
  10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
  the maximum of 16s. This should make unsealing of the node faster in some cases.
• core/raft: Return an error on sys/storage/raft/join if a node that has been removed from raft cluster attempts to re-join when it still has existing raft data on disk. [GH-29090]
• core: Bump Go version to 1.23.6.
• database/couchbase: Update plugin to v0.13.0 [GH-29543]
• database/elasticsearch: Update plugin to v0.17.0 [GH-29542]
• database/mongodbatlas: Update plugin to v0.14.0 [GH-29584]
• database/redis-elasticache: Update plugin to v0.6.0 [GH-29594]
• database/redis: Update plugin to v0.5.0 [GH-29597]
• database/snowflake: Update plugin to v0.13.0 [GH-29554]
• kmip (enterprise): RSA key generation now enforces key sizes of 2048 or higher
• login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [GH-28807]
• proxy/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29517]
• raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
• sdk: Upgrade to go-secure-stdlib/[email protected], which also bumps github.com/docker/docker to v27.2.1+incompatible [GH-28456]
• secrets/ad: Update plugin to v0.20.1 [GH-29648]
• secrets/alicloud: Update plugin to v0.19.0 [GH-29512]
• secrets/aws: The AWS Secrets engine now persists entries to storage between writes. This enables users
  to not have to pass every required field on each write and to make individual updates as necessary.
  Note: in order to zero out a value that is previously configured, users must now explicitly set the
  field to its zero value on an update. [GH-29497]
• secrets/azure: Update plugin to v0.20.1 [GH-28699]
• secrets/azure: Update plugin to v0.21.0 [GH-29639]
• secrets/azure: Update plugin to v0.21.1 [GH-29729]
• secrets/gcp: Update plugin to v0.21.0 [GH-29598]
• secrets/gcp: Update plugin to v0.21.1 [GH-29747]
• secrets/gcpkms: Update plugin to v0.20.0 [GH-29612]
• secrets/kubernetes: Update plugin to v0.10.0 [GH-29592]
• secrets/kv: Update plugin to v0.21.0 [GH-29614]
• secrets/mongodbatlas: Update plugin to v0.14.0 [GH-29583]
• secrets/openldap: Update plugin to v0.14.1 [GH-28479]
• secrets/openldap: Update plugin to v0.14.2 [GH-28704]
• secrets/openldap: Update plugin to v0.14.3 [GH-28780]
• secrets/openldap: Update plugin to v0.14.5 [GH-29551]
• secrets/openldap: Update plugin to v0.15.0 [GH-29605]
• secrets/openldap: Update plugin to v0.15.1 [GH-29727]
• secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see PKI considerations [GH-29045]
• secrets/terraform: Update plugin to v0.11.0 [GH-29541]
• server/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29228]
• storage/raft: Do not allow nodes that have been removed from the raft cluster configuration to respond to requests. Shutdown and seal raft nodes when they are removed. [GH-28875]
• ui: Partially reverts #20431 and removes ability to download unencrypted kv v2 secret data [GH-29290]
• ui: Upgrade Ember data to v5.3.2 (and minor upgrade of ember-cli, ember-source to v5.8.0) [GH-28798]

FEATURES:

• AWS Secrets Cross-Account Management Support (enterprise): Add support for cross-account management of static roles in AWS secrets engine.
• Automated Root Rotation: A schedule or ttl can be defined for automated rotation of the root credential. [GH-29535]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the AWS Auth and AWS Secrets
  plugins. This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29497]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the DB Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29557]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Auth plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29591]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via t...

v1.18.5

[VAULT-34253] This is an automated pull request to build all artifact…

v1.19.0-rc1

1.19.0-rc1

February 21, 2025

SECURITY:

• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0

CHANGES:

• api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the removedcode query parameter. [GH-28991]
• api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the haunhealthycode query parameter. [GH-28991]
• auth/alicloud: Update plugin to v0.20.0 [GH-29613]
• auth/azure: Update plugin to v0.19.1 [GH-28712]
• auth/azure: Update plugin to v0.19.2 [GH-28848]
• auth/azure: Update plugin to v0.20.0 [GH-29606]
• auth/cf: Update plugin to v0.19.1 [GH-29295]
• auth/cf: Update plugin to v0.20.0 [GH-29528]
• auth/gcp: Update plugin to v0.20.0 [GH-29591]
• auth/jwt: Update plugin to v0.23.0 [GH-29553]
• auth/kerberos: Update plugin to v0.14.0 [GH-29617]
• auth/kubernetes: Update plugin to v0.21.0 [GH-29619]
• auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. [GH-29302]
• auth/ldap: No longer return authentication warnings to client. [GH-29134]
• auth/oci: Update plugin to v0.18.0 [GH-29620]
• core (enterprise): Add tracking of performance standbys by their HA node ID so that RPC connections can be more easily cleaned up when nodes are removed. [GH-29303]
• core/raft: Return an error on sys/storage/raft/join if a node that has been removed from raft cluster attempts to re-join when it still has existing raft data on disk. [GH-29090]
• database/couchbase: Update plugin to v0.13.0 [GH-29543]
• database/elasticsearch: Update plugin to v0.17.0 [GH-29542]
• database/mongodbatlas: Update plugin to v0.14.0 [GH-29584]
• database/redis-elasticache: Update plugin to v0.6.0 [GH-29594]
• database/redis: Update plugin to v0.5.0 [GH-29597]
• database/snowflake: Update plugin to v0.13.0 [GH-29554]
• kmip (enterprise): RSA key generation now enforces key sizes of 2048 or higher
• login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [GH-28807]
• raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
• sdk: Upgrade to go-secure-stdlib/[email protected], which also bumps github.com/docker/docker to v27.2.1+incompatible [GH-28456]
• secrets/ad: Update plugin to v0.20.1 [GH-29648]
• secrets/alicloud: Update plugin to v0.19.0 [GH-29512]
• secrets/aws: The AWS Secrets engine now persists entries to storage between writes. This enables users
  to not have to pass every required field on each write and to make individual updates as necessary.
  Note: in order to zero out a value that is previously configured, users must now explicitly set the
  field to its zero value on an update. [GH-29497]
• secrets/azure: Update plugin to v0.20.1 [GH-28699]
• secrets/azure: Update plugin to v0.21.0 [GH-29639]
• secrets/gcp: Update plugin to v0.21.0 [GH-29598]
• secrets/gcpkms: Update plugin to v0.20.0 [GH-29612]
• secrets/kubernetes: Update plugin to v0.10.0 [GH-29592]
• secrets/kv: Update plugin to v0.21.0 [GH-29614]
• secrets/mongodbatlas: Update plugin to v0.14.0 [GH-29583]
• secrets/openldap: Update plugin to v0.14.1 [GH-28479]
• secrets/openldap: Update plugin to v0.14.2 [GH-28704]
• secrets/openldap: Update plugin to v0.14.3 [GH-28780]
• secrets/openldap: Update plugin to v0.14.5 [GH-29551]
• secrets/openldap: Update plugin to v0.15.0 [GH-29605]
• secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see PKI considerations [GH-29045]
• secrets/terraform: Update plugin to v0.11.0 [GH-29541]
• server/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29228]
• storage/raft: Do not allow nodes that have been removed from the raft cluster configuration to respond to requests. Shutdown and seal raft nodes when they are removed. [GH-28875]
• ui: Partially reverts #20431 and removes ability to download unencrypted kv v2 secret data [GH-29290]
• ui: Upgrade Ember data to v5.3.2 (and minor upgrade of ember-cli, ember-source to v5.8.0) [GH-28798]

FEATURES:

• AWS Secrets Cross-Account Management Support (enterprise): Add support for cross-account management of static roles in AWS secrets engine.
• Automated Root Rotation: A schedule or ttl can be defined for automated rotation of the root credential. [GH-29535]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the AWS Auth and AWS Secrets
  plugins. This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29497]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the DB Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29557]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Auth plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29591]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29598]
• Identity De-duplication: Vault can now automatically resolve duplicate
  Entities and Groups by renaming them. This feature is disabled by default and
  can be enabled through the force_identity_deduplication activation flag. [GH-29356]
• Plugins: Allow Enterprise plugins to run externally on Vault Enterprise only.
• Product Usage Reporting: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault feature usage, and adds it to the existing utilization reports. [GH-28858]
• Rotation Manager: Add Rotation Manager to Vault Enterprise Core. The Rotation Manager enables
  plugin users to automate their root credential rotations based on configurable schedules/periods.
• Skip auto import rotation of static roles (enterprise): The Database secrets engine now allows skipping the automatic rotation of static roles during import.
• Transit Ed25519ph and Ed25519ctx support (Enterprise): Support for signing and verifying Ed25519ph and Ed25519ctx signatures types.

IMPROVEMENTS:

• CLI: adds an optional flag (--fail-if-not-fulfilled) to the renew command, which lets the renew command fail on unfulfillable reque...

v1.18.4

1.18.4

January 30, 2025

CHANGES:

• auth/cf: Update plugin to v0.19.1 [GH-29295]
• sdk: Updated golang and dependency versions to be consistent across core, API, SDK to address [GO-2024-3333] and ensure version consistency [GH-29422]

IMPROVEMENTS:

• plugins (enterprise): The Database secrets engine now allows skipping the automatic rotation of static roles during import.
• events (enterprise): Use the path event metadata field when authorizing a client's subscribe capability for consuming an event, instead of requiring data_path to be present in the event metadata.
• ui: Adds navigation for LDAP hierarchical libraries [GH-29293]
• ui: Adds params to postgresql database to improve editing a connection in the web browser. [GH-29200]

BUG FIXES:

• activity: Include activity records from clients created by deleted or disabled auth mounts in Export API response. [GH-29376]
• core: Prevent integer overflows of the barrier key counter on key rotation requests [GH-29176]
• database/mssql: Fix a bug where contained databases would silently fail root rotation if a custom root rotation statement was not provided. [GH-29399]
• plugins: Fix a bug that causes zombie dbus-daemon processes on certain systems. [GH-29334]
• sdk/database: Fix a bug where slow database connections can cause goroutines to be blocked. [GH-29097]
• secrets/pki: Fix a bug that prevented the full CA chain to be used when enforcing name constraints. [GH-29255]
• sentinel (enterprise): No longer report inaccurate log messages for when failing an advisory policy.
• ui (enterprise): Fixes login to web UI when MFA is enabled for SAML auth methods [GH-28873]
• ui: Fixes login to web UI when MFA is enabled for OIDC (i.e. azure, auth0) and Okta auth methods [GH-28873]
• ui: Fixes navigation for quick actions in LDAP roles' popup menu [GH-29293]

v1.18.3

1.18.3

December 18, 2024

CHANGES:

• secrets/openldap: Update plugin to v0.14.4 [GH-29131]
• secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see PKI considerations [GH-29045]

IMPROVEMENTS:

• auth/okta: update to okta sdk v5 from v2. Transitively updates go-jose dependency to >=3.0.3 to resolve GO-2024-2631. See https://github.com/okta/okta-sdk-golang/blob/master/MIGRATING.md for details on changes. [GH-28121]
• core: Added new enable_post_unseal_trace and post_unseal_trace_directory config options to generate Go traces during the post-unseal step for debug purposes. [GH-28895]
• sdk: Add Vault build date to system view plugin environment response [GH-29082]
• ui: Replace KVv2 json secret details view with Hds::CodeBlock component allowing users to search the full secret height. [GH-28808]

BUG FIXES:

• autosnapshots (enterprise): Fix an issue where snapshot size metrics were not reported for cloud-based storage.
• core/metrics: Fix unlocked mounts read for usage reporting. [GH-29091]
• core/seal (enterprise): Fix problem with nodes unable to join Raft clusters with Seal High Availability enabled. [GH-29117]
• core: fix bug in seal unwrapper that caused high storage latency in Vault CE. For every storage read request, the
  seal unwrapper was performing the read twice, and would also issue an unnecessary storage write. [GH-29050]
• secret/db: Update static role rotation to generate a new password after 2 failed attempts. [GH-28989]
• ui: Allow users to search the full json object within the json code-editor edit/create view. [GH-28808]
• ui: Decode connection_url to fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables. [GH-29114]
• vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off. [GH-29128]