HashiCorp

Recently Shipped13 releases · updated Aug 23, 2026

Recently shipped HCP self-service organization deletion and advanced Terraform 1.16 to RC2.

HCP added enterprise constraints, SSO lifecycle controls, and self-serve org deletion. Admins can restrict which products — Vault, Boundary, Vault Radar, Packer, Waypoint, Vagrant — users may deploy. Deleting an SSO connection now removes all SSO users from the org; suspending leaves them intact. Organization owners can delete their org directly in the portal without a support ticket.

Terraform 1.16 reached RC2; 1.15.9 restored child module validation and closed an upload gap. The 1.16 set covers on_failure modes (halt, taint, continue), terraform_data store blocks, nested blocks as computed values, module-level import blocks, and Linux s390x builds. The 1.17 alpha track adds the deferred-actions experiment and test cleanup. The 1.15.9 patch re-enables validation of list, import, backend, and cloud blocks, and updates go-slug to fix a Unicode normalization CVE that could let files bypass .terraformignore during upload.

Vault 2.0.4 patched an ACL bypass and a SCIM boundary escape. Policy parameters normalize to lowercase before evaluation, closing a mixed-case denied_parameters bypass; the entity merge endpoint rejects SCIM-managed entities. Breaking: UBI images dropped gnupg, openssl, and procps.

Nomad 2.0.5 removed a deprecated driver method and added structured plan output. DriverNetwork.Hash is gone (breaking). Native service and Consul check IDs now use SHA256, and nomad job plan gained -json-output and -t flags.

Consul 2.0.3 patched dependency CVEs. Updated brace-expansion (DoS), fast-uri (host confusion), golang.org/x/text, grpc, and socket.io-parser; 2.0.2 upgraded the Alpine base.

Citations: