$npx -y @buildinternet/releases show rel_QCD_zSH1Lot_A4d91J0Me
1.21.5 (September 21, 2025)
SECURITY:
Migrate transitive dependency from archived mitchellh/mapstructure to go-viper/mapstructure to v2 to address CVE-2025-52893. [GH-22581]
agent: Add the KV Validations to block path traversal allowing access to unauthorized endpoints. [GH-22682]
agent: Fix a security vulnerability to filter out anonymous tokens along with empty tokens when setting the Results-Filtered-By-ACLs header [GH-22534]
agent: Fix a security vulnerability where the attacker could read agent’s TLS certificate and private key by using the group ID that the Consul agent runs as. [GH-22626]
api: add charset in all applicable content-types. [GH-22598]
connect: Upgrade envoy version to 1.34.7 [GH-22735]
security: Fix GHSA-65rg-554r-9j5x (CVE-2024-48908) by upgrading lycheeverse/lychee-action. [GH-22667]
security: Fix a security vulnerability where the attacker could bypass authentication by passing url params as there was no validation on them. [GH-22612]
security: perform constant time compare for sensitive values. [GH-22537]
security:: (Enterprise only) fix potential race condition in partition CRUD.
security:: (Enterprise only) perform constant time compare for sensitive values.
FEATURES:
config: Add new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream [GH-22604]
config: Handle a new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream in API Gateway config and proxy-defaults [GH-22679]
config: Handle a new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Mesh Gateway via service-defaults and proxy-defaults [GH-22722]
config: Handle a new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Terminating Gateway service-defaults and proxy-defaults [GH-22680]
IMPROVEMENTS:
cli: add troubleshoot ports in debug command. A ports.json file is created, which lists the open or closed ports on the host where the command is executed. [GH-22624]
BUG FIXES:
agent: Don't show admin partition during errors [GH-11154]