v1.15.9+ent

1.15.9 Enterprise

May 30, 2024

This release is created to share the Vault Enterprise changelog and notify consumers of availability. The attached source and assets do not include Vault Enterprise code and should not be used in place of official Docker images or binaries.

CHANGES:

• auth/jwt: Update plugin to v0.17.3 [GH-27063]
• core: Bump Go version to 1.22.2.

IMPROVEMENTS:

• secrets/pki (enterprise): Disable warnings about unknown parameters to the various CIEPS endpoints
• website/docs: Add note about eventual consietency with the MongoDB Atlas database secrets engine [GH-24152]

BUG FIXES:

• activity (enterprise): fix read-only storage error on upgrades
• core: Address a data race updating a seal's last seen healthy time attribute [GH-27014]
• pki: Fix error in cross-signing using ed25519 keys [GH-27093]
• replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
• secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [GH-27211]
• ui: Fix KVv2 cursor jumping inside json editor after initial input. [GH-27120]

v1.14.13+ent

1.14.13 Enterprise

May 30, 2024

This release is created to share the Vault Enterprise changelog and notify consumers of availability. The attached source and assets do not include Vault Enterprise code and should not be used in place of official Docker images or binaries.

CHANGES:

• auth/jwt: Update plugin to v0.16.1 [GH-27122]
• core: Bump Go version to 1.22.2.

IMPROVEMENTS:

• website/docs: Add note about eventual consietency with the MongoDB Atlas database secrets engine [GH-24152]

BUG FIXES:

• activity (enterprise): fix read-only storage error on upgrades
• pki: Fix error in cross-signing using ed25519 keys [GH-27093]
• replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
• secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [GH-27211]

v1.16.3

1.16.3

May 30, 2024

CHANGES:

• auth/jwt: Update plugin to v0.20.3 [GH-26890]
• core/identity: improve performance for secondary nodes receiving identity related updates through replication [GH-27184]
• core: Bump Go version to 1.22.2.

IMPROVEMENTS:

• secrets/pki (enterprise): Disable warnings about unknown parameters to the various CIEPS endpoints
• ui: Update PGP display and show error for Generate Operation Token flow with PGP [GH-26993]

BUG FIXES:

• activity (enterprise): fix read-only storage error on upgrades
• auto-auth: Addressed issue where having no permissions to renew a renewable token caused auto-auth to attempt to renew constantly with no backoff [GH-26844]
• core (enterprise): Fix an issue that prevented the seal re-wrap status from reporting that a re-wrap is in progress for up to a second.
• core/audit: Audit logging a Vault request/response will now use a minimum 5 second context timeout.
  If the existing context deadline occurs later than 5s in the future, it will be used, otherwise a
  new context, separate from the original will be used. [GH-26616]
• core: Add missing field delegated_auth_accessors to GET /sys/mounts/:path API response [GH-26876]
• core: Address a data race updating a seal's last seen healthy time attribute [GH-27014]
• core: Fix redact_version listener parameter being ignored for some OpenAPI related endpoints. [GH-26607]
• events (enterprise): Fix bug preventing subscribing and receiving events within a namepace.
• pki: Fix error in cross-signing using ed25519 keys [GH-27093]
• replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
• secrets-sync (enterprise): Secondary nodes in a cluster now properly check activation-flags values.
• secrets/azure: Update vault-plugin-secrets-azure to 0.17.2 to include a bug fix for azure role creation [GH-26896]
• secrets/pki (enterprise): cert_role parameter within authenticators.cert EST configuration handler could not be set
• secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [GH-27211]
• ui: Fix KVv2 cursor jumping inside json editor after initial input. [GH-27120]
• ui: Fix KVv2 json editor to allow null values. [GH-27094]
• ui: Fix broken help link in console for the web command. [GH-26858]
• ui: Fix link to v2 generic secrets engine from secrets list page. [GH-27019]
• ui: Prevent perpetual loading screen when Vault needs initialization [GH-26985]
• ui: Refresh model within a namespace on the Secrets Sync overview page. [GH-26790]

v1.17.0-rc1

[VAULT-27613] This is an automated pull request to build all artifact…

v1.15.8+ent

1.15.8 Enterprise

April 24, 2024

This release is created to share the Vault Enterprise changelog and notify consumers of availability. The attached source and assets do not include Vault Enterprise code and should not be used in place of official Docker images or binaries.

CHANGES:

• core: Bump Go version to 1.21.9.
• ui: Update dependencies including D3 libraries [GH-26346]

IMPROVEMENTS:

• activity (enterprise): Change minimum retention window in activity log to 48 months
• core: make the best effort timeout for encryption count tracking persistence configurable via an environment variable. [GH-25636]
• license utilization reporting (enterprise): Add retention months to license utilization reports.
• sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once. [GH-26464]
• ui: show banner instead of permission denied error when batch token is expired [GH-26396]

BUG FIXES:

• core (enterprise): fix bug where raft followers disagree with the seal type after returning to one seal from two. [GH-26523]
• secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points. [GH-26477]
• storage/raft (enterprise): Fix a bug where autopilot automated upgrades could fail due to using the wrong upgrade version
• ui: fixed a bug where the replication pages did not update display when navigating between DR and performance [GH-26325]

v1.15.7+ent

1.15.7 Enterprise

March 28, 2024

This release is created to share the Vault Enterprise changelog and notify consumers of availability. The attached source and assets do not include Vault Enterprise code and should not be used in place of official Docker images or binaries.

SECURITY:

• auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request [GH-26091]

IMPROVEMENTS:

• auth/cert: Allow validation with OCSP responses with no NextUpdate time [GH-25912]
• core (enterprise): Avoid seal rewrapping in some specific unnecessary cases.
• core (enterprise): persist seal rewrap status, so rewrap status API is consistent on secondary nodes.
• ui: remove leading slash from KV version 2 secret paths [GH-25874]

BUG FIXES:

• audit: Operator changes to configured audit headers (via /sys/config/auditing)
  will now force invalidation and be reloaded from storage when data is replicated
  to other nodes.
• auth/cert: Address an issue in which OCSP query responses were not cached [GH-25986]
• auth/cert: Allow cert auth login attempts if ocsp_fail_open is true and OCSP servers are unreachable [GH-25982]
• cli: fixes plugin register CLI failure to error when plugin image doesn't exist [GH-24990]
• core (enterprise): fix issue where the Seal HA rewrap system may remain running when an active node steps down.
• core/login: Fixed a potential deadlock when a login fails and user lockout is enabled. [GH-25697]
• replication (enterprise): fixed data integrity issue with the processing of identity aliases causing duplicates to occur in rare cases
• ui: Fix kubernetes auth method roles tab [GH-25999]
• ui: call resultant-acl without namespace header when user mounted at root namespace [GH-25766]

v1.14.12+ent

1.14.12 Enterprise

April 24, 2024

This release is created to share the Vault Enterprise changelog and notify consumers of availability. The attached source and assets do not include Vault Enterprise code and should not be used in place of official Docker images or binaries.

CHANGES:

• core: Bump Go version to 1.21.9.
• ui: Update dependencies including D3 libraries [GH-26346]

IMPROVEMENTS:

• activity (enterprise): Change minimum retention window in activity log to 48 months
• core: make the best effort timeout for encryption count tracking persistence configurable via an environment variable. [GH-25636]
• license utilization reporting (enterprise): Add retention months to license utilization reports.
• sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once. [GH-26464]
• ui: show banner instead of permission denied error when batch token is expired [GH-26396]

BUG FIXES:

• secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points. [GH-26477]
• storage/raft (enterprise): Fix a bug where autopilot automated upgrades could fail due to using the wrong upgrade version

v1.14.11+ent

1.14.11 Enterprise

March 28, 2024

This release is created to share the Vault Enterprise changelog and notify consumers of availability. The attached source and assets do not include Vault Enterprise code and should not be used in place of official Docker images or binaries.

SECURITY:

• auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request [GH-26091]

CHANGES:

• core: Bump Go version to 1.21.8.

IMPROVEMENTS:

• auth/cert: Allow validation with OCSP responses with no NextUpdate time [GH-25912]
• openapi: Fix generated types for duration strings [GH-20841]
• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20221104090112-13395acd02c5

BUG FIXES:

• auth/cert: Address an issue in which OCSP query responses were not cached [GH-25986]
• auth/cert: Allow cert auth login attempts if ocsp_fail_open is true and OCSP servers are unreachable [GH-25982]
• core/login: Fixed a potential deadlock when a login fails and user lockout is enabled. [GH-25697]
• openapi: Fixing response fields for rekey operations [GH-25509]
• ui: Fix kubernetes auth method roles tab [GH-25999]

v1.16.2

[VAULT-26312] This is an automated pull request to build all artifact…

v1.16.1

1.16.1

April 04, 2024

Please note that Vault 1.16.1 is the first Enterprise release of the Vault Enterprise 1.16 series.

BUG FIXES:

• auth/ldap: Fix login error for group search anonymous bind. [GH-26200]
• auth/ldap: Fix login error missing entity alias attribute value. [GH-26200]
• cli: fixed a bug where the Vault CLI would error out if HOME was not set. [GH-26243]
• core: Only reload seal configuration when enable_multiseal is set to true. [GH-26166]
• secret/database: Fixed race condition where database mounts may leak connections [GH-26147]