---
scope: org
organization: hashicorp
release_count: 15
last_release: 2026-10-14
generated: 2026-04-21
updated: 2026-10-16
canonical: https://releases.sh/hashicorp/overview.md
---

Vault 2.2.0 landed with container and PostgreSQL storage changes that break existing setups, and Vault 2.1 reached HCP Vault Dedicated.

**Vault 2.2 breaks container and PostgreSQL storage setups.**
- Container images no longer carry `cap_ipc_lock`; set `disable_mlock = true` and disable swap on the host
- UBI images drop gnupg, openssl, and procps
- PostgreSQL storage now prefers Azure Workload Identity over Managed Identity — existing Managed Identity configs may stop working until migrated

**Terraform Policy is generally available.**
- `-policies` on `plan`, `apply`, and `query` no longer requires an experimental build or `-allow-experimental-features`
- Provider requirements now accept variables and locals; `-minimal-refresh` refreshes only resources with proposed changes
- 1.16.6 patched an HTTP/2 resource exhaustion issue (CVE-2026-78669), exploitable only via a compromised registry

**Consul's transparent proxy setup moved to nftables (breaking).** `consul connect redirect-traffic` applies IPv4 and IPv6 rules atomically through the `nftables` `inet` family, and validates exclusions up front — numeric user IDs, IP or CIDR outbound exclusions. It does not remove `iptables`/`ip6tables` rules left by earlier versions, so strip those before upgrading a host in place. Tokens need `mesh:write` to attach builtin Lua or WASM EnvoyExtensions or set xDS escape-hatch keys.

**Nomad and HCP wrap-up.** Nomad 2.0.7 allows wildcard namespace queries for native services. Vault 2.1 is rolling out to HCP Vault Dedicated clusters on AWS and Azure.