SECURITY:
cloudflare/circl to v1.6.3 to resolve CVE-2026-1229filippo.io/edwards25519 to v1.1.1 to resolve GO-2026-4503cloudflare/circl to v1.6.3 to resolve CVE-2026-1229go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.
CHANGES:
core: Bump Go version to 1.25.6
FEATURES:
UI: Hashi-Built External Plugin Support: Recognize and support Hashi-built plugins when run as external binaries
IMPROVEMENTS:
core/managed-keys (enterprise): Allow GCP managed keys to leverage workload identity federation credentials sdk: Add alias_metadata to tokenutil fields that auth method roles use. secret-sync (enterprise): Added telemetry counters for reconciliation loop operations, including the number of corrections detected, retry attempts, and operation outcomes (success or failure with internal/external cause labels). secret-sync (enterprise): Added telemetry counters for sync/unsync operations with status breakdown by destination type, and exposed operation counters in the destinations list API response.
BUG FIXES:
agent: Fix Vault Agent discarding cached tokens on transient server errors instead of retrying core (enterprise): Fix crash when seal HSM is disconnected default-auth: Fix issue when specifying "root" explicitly in Default Auth UI identity: Fix issue where Vault may consume more memory than intended under heavy authentication load. secrets/pki (enterprise): Fix SCEP related digest errors when requests contained compound octet strings ui: Fixes login form so ?with=<path> query param correctly displays only the specified mount when multiple mounts of the same auth type are configured with listing_visibility="unauth" ui: Reverts Kubernetes CA Certificate auth method configuration form field type to file selector
CHANGES:
IMPROVEMENTS:
BUG FIXES:
crl_distribution_points.SECURITY:
CHANGES:
IMPROVEMENTS:
sys/reporting/scan endpoint which will output a set of files containing information about Vault state to the location specified by the reporting_scan_directory config item.vault.route.read-snapshot.{mount_point} and vault.route.list-snapshot.{mount_point} metrics.server_flag, client_flag, code_signing_flag, and email_protection_flag parameters for creating/updating a role.BUG FIXES:
alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.alias_metadata now populates alias custom metadata field instead of alias metadata.key_usage extension so details accurately reflect certificate values.basic_constraints_valid_for_non_ca is correctly set.SECURITY:
BUG FIXES:
SECURITY:
CHANGES:
start_time and end_time in sys/internal/counters/activity are aligned to the corresponding billing period.end_time in sys/internal/counters/activity is now capped at the end of the last completed month. [GH-30164]Retry-After header and, if it exists, wait for the specified duration before retrying the request. [GH-30887]resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]Retry-After value to the nearest second when calculating the retry delay. [GH-30887]namespace, mount_path, mount_type or number of clients for
a selected month. [GH-30678]FormError component (not used) [GH-34699]/vault/auth?with= query parameter [GH-30500]/vault/auth?with= query parameter now exclusively refers to the auth mount path and renders a simplified form [GH-30500]FEATURES:
remove_irrevocable_lease_after. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [GH-30703]development_cluster as a field to Vault's utilization reports.
The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [GH-30659]group_by field to the rate limit quota API to support different grouping modes.IMPROVEMENTS:
/sys/utilization-report, giving a snapshot overview of Vault's utilization at a high level.vault.core.response_status_code, with two labels, code, and type, detailing the status codes of all responses to requests that Vault handles. [GH-30354]vault_index to an event's metadata if the metadata contains modified=true, to support client consistency controls when reading from Vault in response to an event where storage was modified. [GH-30725]VAULT_MYSQL_USERNAME and VAULT_MYSQL_PASSWORD. [GH-30136]listing_visibility="unauth"; all methods can be accessed via the "Sign in with other methods" link [GH-30500]DEPRECATIONS:
/sys/internal/counters/tokens endpoint. Attempting to call this endpoint will return a 403 "unsupported path" exception. [GH-30561]BUG FIXES:
plugin_tmpdir config [GH-29978]plugin_tmpdir configauto_join configurations that include escape characters [GH-29874]NextVaultRotation is nil.
Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value.
Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]private_key after generating [GH-30778]config block [GH-30960]SECURITY:
CHANGES:
start_time and end_time in sys/internal/counters/activity are aligned to the corresponding billing period.end_time in sys/internal/counters/activity is now capped at the end of the last completed month. [GH-30164]resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]namespace, mount_path, mount_type or number of clients for
a selected month. [GH-30678]FormError component (not used) [GH-34699]/vault/auth?with= query parameter [GH-30500]/vault/auth?with= query parameter now exclusively refers to the auth mount path and renders a simplified form [GH-30500]FEATURES:
remove_irrevocable_lease_after. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [GH-30703]development_cluster as a field to Vault's utilization reports.
The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [GH-30659]group_by field to the rate limit quota API to support different grouping modes.IMPROVEMENTS:
/sys/utilization-report, giving a snapshot overview of Vault's utilization at a high level.vault.core.response_status_code, with two labels, code, and type, detailing the status codes of all responses to requests that Vault handles. [GH-30354]vault_index to an event's metadata if the metadata contains modified=true, to support client consistency controls when reading from Vault in response to an event where storage was modified. [GH-30725]VAULT_MYSQL_USERNAME and VAULT_MYSQL_PASSWORD. [GH-30136]listing_visibility="unauth"; all methods can be accessed via the "Sign in with other methods" link [GH-30500]DEPRECATIONS:
/sys/internal/counters/tokens endpoint. Attempting to call this endpoint will return a 403 "unsupported path" exception. [GH-30561]BUG FIXES:
plugin_tmpdir config [GH-29978]auto_join configurations that include escape characters [GH-29874]NextVaultRotation is nil.
Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value.
Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]private_key after generating [GH-30778]Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
CHANGES:
IMPROVEMENTS:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
CHANGES:
BUG FIXES:
plugin_tmpdir config [GH-29978]CHANGES:
BUG FIXES:
NextVaultRotation is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value. Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
CHANGES:
resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]IMPROVEMENTS:
BUG FIXES: