HashiCorp

Fixed bufio.Scanner: token too long errors when logging requests or responses containing long lines.

October 15, 2026

BREAKING CHANGES:

• containers: Remove cap_ipc_lock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory. Operators should set…

Adds new resources and list resources for aws_cloudwatchomni_domain, aws_cloudwatchomni_space, aws_devopsagent_agent_space, aws_pricingplanmanager_subscription, and aws_cloudwatch_resource_metrics_configuration, plus resource identity support for aws_ram_principal_association and aws_ssm_service_setting and expanded arguments across CloudWatch, Bedrock, WAFv2, and RDS. Fixes include erroneous forced replacement on aws_ec2_transit_gateway_peering_attachment and a Read failure in aws_api_gateway_method.

Vault 2.1 has begun rolling out to HCP Vault Dedicated clusters on AWS and Azure, bringing the Vault 2.1.2 capabilities to HCP Vault.

Connect sidecar proxies and terminating gateways now receive leaf certificates and CA roots over SDS instead of inline in the listener filter chain, so leaf rotation no longer changes the filter chain hash and established connections (including long-lived TCP sessions) are not drained. Also fixes two proxycfg goroutine and memory leaks and restores Raft, Serf, and Memberlist metrics by building with the hashicorpmetrics tag.

6.68.0 (October 7, 2026)

Terraform Policy is now generally available, and the -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Also added the -minimal-refresh planning option, which refreshes only resources with proposed changes, and support for variables and locals in provider requirements.

Fixed a crash when a tainted instance state is seen without a valid status, and an issue where resource identity could be nil during delete.

6.67.0 (September 30, 2026)

The consul connect redirect-traffic command and transparent proxy redirection now use nftables instead of iptables/ip6tables, requiring the nft binary and Linux kernel 5.2 or later, with no automatic fallback; the official container image now ships nftables in place of iptables. API Gateway listeners also accept http2 and grpc protocols, enabling end-to-end HTTP/2 and gRPC instead of silently downgrading to HTTP/1.1.

6.66.0 (September 21, 2026)

Fixed bugs where namespaces and node pools could stop replicating between federated regions or be deleted in a follower region by an invalid replication token. Also fixes task restarts skipping shutdown_delay, image_pull_timeout not being respected past 5min, and unchanged jobs creating new versions when submitted with a different ACL token.

1.16.1 (September 18, 2026)

Updates github.com/apache/thrift to v0.24.0, golang.org/x/crypto to v0.56.0, and google.golang.org/grpc to v1.83.2 to fix ghsa-8wv5-x4w7-5gww, GO-2026-6354, GO-2026-6355, and GHSA-2v4p-qf9q-27wj. Also fixes auth/token/lookup returning 403 for JWT tokens in non-root namespaces, a panic in vault recover without a path, and OIDC identity token billing units computed incorrectly across periodic flush cycles.