HashiCorp Consul: baixar versions anteriors

BREAKING CHANGES:
- acl: Tokens that hold service:write but not mesh:write will now receive a permission-denied error when attempting to attach builtin/lua or builtin/wasm EnvoyExtensions (or upstream envoy_listener_json/envoy_cluster_json escape-hatch overrides) to a service-defaults config entry, or when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys set in the top-level Proxy.Config map or per-upstream in Proxy.Upstreams[*].Config. Operators must grant mesh:write to any token that legitimately needs these capabilities. [GH-23864]
- fips: (Enterprise only) FIPS release artifacts are renamed. Version metadata changes from +ent.fips1402 to +ent.fips1403, and package and container artifacts change from the F2 suffix to F3 (for example, consul-F2_1.20.4-1_amd64.deb becomes consul-F3_1.20.4-1_amd64.deb). Pipelines that pin FIPS artifact names or version strings must be updated.
SECURITY:
- Upgrade go version to 1.26.7 to address security vulnerabilities. [GH-23869]
- acl: Require mesh:write in addition to service:write when attaching code-executing EnvoyExtensions (builtin/lua, builtin/wasm) or upstream escape-hatch overrides (envoy_listener_json, envoy_cluster_json in UpstreamConfig defaults or overrides) to a service-defaults config entry. Previously a holder of service:write on a service could attach a Lua script or Wasm module, or an upstream escape-hatch override, that Envoy compiled and executed on every proxied request as the sidecar process user, with access to mTLS private keys, request bodies, and the host filesystem. [GH-23864]
- acl: Require mesh:write in addition to service:write when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys, whether set in the top-level Proxy.Config map or per-upstream in Proxy.Upstreams[*].Config (envoy_bootstrap_json_tpl, envoy_extra_static_listeners_json, envoy_public_listener_json, envoy_listener_json, envoy_cluster_json, envoy_local_cluster_json, envoy_extra_static_clusters_json, envoy_extra_stats_sinks_json, envoy_tracing_json, envoy_stats_config_json, envoy_listener_tracing_json). Key matching is case-insensitive to match the mapstructure decoding used downstream. Previously a holder of service:write on the proxy and its destination could inject arbitrary Envoy filter chain configuration into the sidecar bootstrap or xDS resources, including via a per-upstream override or a mixed-case key. [GH-23864]
- agent: Fixed a pre-authorization memory exhaustion vulnerability where
an mTLS-authenticated RPC client with no ACL token could terminate a Consul server by
sending a MessagePack request header with a large declared length. The MessagePack
decoder allocated a byte slice of the declared size before method lookup, ACL token
validation, or the rate-limiting interceptor could run, allowing a single oversized
header to OOM-kill the server process.
Two mitigations are applied:
1. Each RPC request header is now validated against RPCMaxHeaderBytes (default 512
bytes) before it is decoded. Every length prefix in the header is checked against
the limit, so an oversized value is rejected before the decoder allocates memory
for it, and the connection is closed before any ACL evaluation. Request bodies
remain unbounded by this limit.
2. A per-request read deadline (reusing RPCHandshakeTimeout) is applied inside
handleConsulConn and handleInsecureConn so that a slow attacker trickling an
oversized header cannot retain a goroutine and logical heap indefinitely.
- catalog: Fixed an incorrect authorization vulnerability where a local
ACL token with service:write or node:write could delete peer-imported catalog
objects by supplying a non-default PeerName in a Catalog.Deregister request.
Authorization was checked only against the local service or node name, not the peer
origin, allowing deletion of objects in a peer-scoped catalog namespace the caller
does not control. Catalog.Deregister now rejects any request whose PeerName is
not the default, mirr

SECURITY:
- Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786]
- Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786]
- Update golang.org/x/text to v0.39.0 to address GO-2026-5970. [GH-23761]
- Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf. [GH-23761]
- Update socket.io-parser to address CVE-2026-69185 (Zero-attachment Memory Exhaustion). [GH-23786]
- Upgrade to use Go 1.26.5. This resolves vulnerabilities
GO-2026-4970 (os).
GO-2026-5856 (crypto/tls). [GH-23761]
- agent: Fixed a denial-of-service vulnerability where GET /v1/agent/connect/ca/roots
and POST /v1/agent/connect/authorize used the agent-side cache unconditionally, even
when http_config { use_cache = false } was configured by the operator. A remote caller
could bypass this setting and grow the agent cache without bound by varying the request
ACL token. Both endpoints now skip the cache and issue a direct RPC when use_cache is
disabled. (SECVULN-50292, SECVULN-50293) [GH-23797]
- agent: Fixed a nil-pointer dereference panic in ShadowServiceRouterConfigEntry.CheckEnt
when a service-router config entry contained a route with a nil Destination. A crafted
snapshot restore or replication message containing such an entry could crash the FSM
decode path. The nil guard now treats a missing destination as non-enterprise data and
continues decoding safely. (SECVULN-50291) [GH-23797]
- agent: Fixed a security bypass where a user-supplied public listener
(envoy_public_listener_json) with an HTTP Connection Manager filter would skip Consul's
inbound request-normalization defaults. An attacker could exploit the un-normalized path
to bypass L7 intention deny rules using percent-encoded path equivalents. Consul now
injects path normalization (enabled by default, unless the mesh config option
InsecureDisablePathNormalization is set) on every HCM filter chain in user-provided
public listeners before L7 intention enforcement is applied. (SECVULN-50295) [GH-23797]
- agent: Fixed an unauthenticated denial-of-service vulnerability where
PUT /v1/agent/check/update/:id, PUT /v1/agent/check/register,
PUT /v1/agent/service/register, and POST /v1/agent/connect/authorize
decoded unbounded JSON request bodies before resolving the caller's ACL
token. An unauthenticated caller could retain multiple large JSON decoder
buffers concurrently inside the Consul process before each request was
rejected with HTTP 403, causing attacker-controlled heap growth. All four
endpoints now cap the request body at 512 KiB before any decoding occurs,
returning HTTP 413 for oversized bodies. This limit applies to chunked
transfer encoding as well as declared Content-Length.
(SECVULN-50418) [GH-23796]
- agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC
and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP
before any request processing, ACL check, or rate limiting could occur. A remote attacker
could exhaust agent file descriptors, goroutines, and memory by opening many connections
and withholding the gRPC or TLS handshake. A new per-client-IP connection limiter is now
applied before the gRPC server observes the connection, controlled by the new
limits.grpc_max_conns_per_client configuration option (default 100). The gRPC handshake
timeout has also been reduced from the library default of 120 seconds to 20 seconds.
(SECVULN-50294) [GH-23797]
IMPROVEMENTS:
- ui: migrate yadda/Gherkin acceptance tests to native QUnit (harness, intentions/create, components, settings) [GH-23741]
- xds: Add two new opt-in ProxyDefaults.spec.config keys for controlling the server response header on API Gateway HTTP listeners: envoy_suppress_envoy_headers (removes the header entirely) and envoy_server_header_name (renames it to a custom value). If both are set, suppress takes precedence. [GH-13027]
BUG FIXES:
- agent: Stop logging the raw

SECURITY:
- Upgrade alpine base image version to 3.24 to address [CVE-2026-41989], [ALPINE-CVE-2026-2100]. [GH-23711]
- dependency: Upgrade Serf and Memberlist to use the latest versions. [GH-23704]
- xds: Return errors when injecting the L4 intention (RBAC) filter or the mTLS transport socket onto an inbound public listener, so the listener is not served without intention enforcement or mTLS. [GH-23686]
FEATURES:
- config-entry(api-gateway): (Enterprise only) Add ExtAuthzFilter to HTTPRoute Filters and gateway-wide ExtAuthz toggle to the api-gateway config entry [GH-23703]
- config-entry: (Enterprise only) Addition of External Processor (ext_proc) Envoy Extension support to api-gateway and connect-proxy [GH-23705]
IMPROVEMENTS:
- ci: upgrade GitHub Actions that used the deprecated Node 20 runtime to Node 24, and restore GOTOOLCHAIN=auto after setup-go so backward-compatibility and integration test lanes resolve the correct Go toolchain. [GH-23687]
- connect: update support for nomad and vault version to v2.0.3 [GH-23624]
- deps: Migrate armon/go-metrics to hashicorp/go-metrics and update Go dependencies across all modules [GH-23635]
BUG FIXES:
- xds: only emit the client cert SDS block when both CertFile and KeyFile are set. [GH-23679]

SECURITY:
- Upgrade go version to 1.26.4 to address GO-2026-5039, GO-2026-5038,GO-2026-5037 [GH-23637]
- connect: Upgrade envoy version to 1.37.4, 1.36.8, 1.35.12; Add new version of Envoy 1.38.2 and remove 1.34.14 [GH-23664]
IMPROVEMENTS:
- dockerfile: layer reduction by merging RUN commands and minor changes following best practices. [GH-23650]
- product-telemetry: product usage reporting now preserves export cadence across restarts and leader re-elections by resuming from the last successful export time, preventing delays
- server: Auth method TokenNameFormat field accepts OIDC and JWT claim mapping values [GH-23616]
- ui: Removed block-slot addon dependency [GH-23481]
BUG FIXES:
- connect: Strip the x-forwarded-client-cert header from inbound HTTP requests before forwarding them to local service instances. [GH-23544]
- server: Fixed a bug where renaming a server (or wiping and rejoining it with the same IP and Raft node ID) could cause an out-of-order serf event to evict the live leader from the internal server lookup, resulting in Raft leader not found in server lookup mapping (HTTP 500) errors on follower RPCs until the next member event resynced the mapping. [GH-23533]
2.0.0 (May 22, 2026)
SECURITY:
- connect: Upgrade envoy version to 1.37.2 and newer versions [GH-23469]
- go: Upgrade go version to 1.26 [GH-23493]
- agent: Increased default HTTP server timeouts to prevent breaking long-polling blocking queries. read_timeout and write_timeout are now set to 15 minutes (up from 30 seconds), while read_header_timeout (10s) and idle_timeout (120s) still provide protection against Slowloris attacks. All timeouts remain configurable via the http_config block. [GH-23267]
- api-gateway, terminating-gateway: Apply HTTP request path normalization on api-gateway and terminating-gateway HTTP listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005). [GH-23534]
- docker: update ubi base image to ubi9-minimal:9.7. [GH-23553]
- docker: Upgrade curl to >= 8.20.0 from Alpine edge in the container image to address
CVE-2026-6429,
CVE-2026-4873,
CVE-2026-5773,
CVE-2026-6253,
CVE-2026-6276,
CVE-2026-7168,
CVE-2026-5545.
Alpine 3.23 stable does not yet carry the patched version. [GH-23750]
- docker: Update to UBI base image to 9.8 for fixing [CVE_2026-2100] [GH-23588]
FEATURES:
- (Enterprise Only) update to go-licensing/v4 and go-census/v3 inorder to adapt to new licenses of PAO.
- Global Rate Limiter: (Enterprise Only) a new "rate-limit" config entry kind that enables dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers. This allows operators to apply or adjust global rate limits at runtime without restarting Consul servers — a critical capability for emergency scenarios where the cluster is under excessive load.
- api-gateway: Added SDS certificate support for API Gateway listeners, including listener-level default TLS certificates and HTTP/TCP route service TLS SDS overrides. Service overrides inherit the listener SDS cluster when omitted, and gateway validation/xDS generation now rejects conflicting override mappings to keep certificate selection deterministic. [GH-23354]
- api-gateway: add support for gateway-level default upstream limits and route service-level limit overrides for MaxConnections, MaxPendingRequests, and MaxConcurrentRequests. [GH-23396]
- api: Added new API "/v1/internal/rpc/methods" that lists all RPC method names. Requires an operator:read ACL token. This is useful when users want to configure rate limits that exclude specific RPC endpoints. [GH-23329]
- ca: (Enterprise Only) Added new Connect CA provider for Cyberark WIM (connect.ca_provider = "pan-distributed-issuer"), enabling Consul to issue certificates through Cyberark WIM.
- server: (Enterprise Only) add stable cluster identity and leader-gated global registry sync for service summary publishing.
- telemetry: (Enterprise Only) Product telemetry for self-managed Consul with anonymous, o

SECURITY:
- connect: Upgrade envoy version to 1.37.2 and newer versions [GH-23469]
- go: Upgrade go version to 1.26 [GH-23493]
- agent: Increased default HTTP server timeouts to prevent breaking long-polling blocking queries. read_timeout and write_timeout are now set to 15 minutes (up from 30 seconds), while read_header_timeout (10s) and idle_timeout (120s) still provide protection against Slowloris attacks. All timeouts remain configurable via the http_config block. [GH-23267]
- api-gateway, terminating-gateway: Apply HTTP request path normalization on api-gateway and terminating-gateway HTTP listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005). [GH-23534]
- docker: update ubi base image to ubi9-minimal:9.7. [GH-23553]
- docker: Upgrade curl to >= 8.20.0 from Alpine edge in the container image to address
CVE-2026-6429,
CVE-2026-4873,
CVE-2026-5773,
CVE-2026-6253,
CVE-2026-6276,
CVE-2026-7168,
CVE-2026-5545.
Alpine 3.23 stable does not yet carry the patched version. [GH-23750]
- docker: Update to UBI base image to 9.8 for fixing [CVE_2026-2100] [GH-23588]
FEATURES:
- (Enterprise Only) update to go-licensing/v4 and go-census/v3 inorder to adapt to new licenses of PAO.
- Global Rate Limiter: (Enterprise Only) a new "rate-limit" config entry kind that enables dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers. This allows operators to apply or adjust global rate limits at runtime without restarting Consul servers — a critical capability for emergency scenarios where the cluster is under excessive load.
- api-gateway: Added SDS certificate support for API Gateway listeners, including listener-level default TLS certificates and HTTP/TCP route service TLS SDS overrides. Service overrides inherit the listener SDS cluster when omitted, and gateway validation/xDS generation now rejects conflicting override mappings to keep certificate selection deterministic. [GH-23354]
- api-gateway: add support for gateway-level default upstream limits and route service-level limit overrides for MaxConnections, MaxPendingRequests, and MaxConcurrentRequests. [GH-23396]
- api: Added new API "/v1/internal/rpc/methods" that lists all RPC method names. Requires an operator:read ACL token. This is useful when users want to configure rate limits that exclude specific RPC endpoints. [GH-23329]
- ca: (Enterprise Only) Added new Connect CA provider for Cyberark WIM (connect.ca_provider = "pan-distributed-issuer"), enabling Consul to issue certificates through Cyberark WIM.
- server: (Enterprise Only) add stable cluster identity and leader-gated global registry sync for service summary publishing.
- telemetry: (Enterprise Only) Product telemetry for self-managed Consul with anonymous, opt-in usage reporting.
- mesh: (Enterprise Only) Introduce support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names, as well as to retrieve virtual IPs for specific service ports. It also enforces that certain advanced multi-port features are only available in Consul Enterprise, and includes new utility functions for cluster naming and ALPN protocol generation.
IMPROVEMENTS:
- agent: (Enterprise Only) Add eventually-consistent background cache for Enterprise usage metrics, reducing GET /v1/operator/usage latency from O(PNK) to O(1) and lowering CPU/memory pressure during high-frequency scraping via a watch-driven maintainer goroutine.
- mesh: (Enterprise Only) Introduce support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names, as well as to retrieve virtual IPs for specific service ports. It also enforces that certain advanced multi-port features are only available in Consul Enterprise, and includes new utility functions for cluster naming and ALPN protocol generation.
- terminating-gateway: Updated the cluster upstream tls to use sds instead of static certs, allowi

SECURITY:
- security: update google.golang.org/grpc to fix CVE-2026-33186 [GH-23379]
- security: upgrade go.opentelemetry.io/otel to 1.42.0 to remediate CVE-2026-24051 (Path Hijacking / Untrusted Search Paths on macOS). [GH-23387]
- test-sds-server: bump github.com/hashicorp/consul to v1.22.5 in integration test module to align with the CVE-2026-2808 fixed release line. [GH-23437]
- ui: (Enterprise only) Backport Rollup update to 2.80.0 for release/1.21.x to address CVE-2026-27606 (SECVULN-38912). [GH-23359]
IMPROVEMENTS:
- acl: Addition of TokenNameFormat field to auth-method and parse the same for token name [GH-23444]
- discovery-chain: removes the use of hashstructure_v2 ([github.com/mitchellh/hashstructure/v2] from compiled discovery chain hashing and replaces it with explicit custom hash implementations. [GH-23393]
- ui: removed consul docs website related code as it is being maintained in a separate internal repository. [GH-23398]
BUG FIXES:
- api-gateway: fix HTTPRoute PathPrefix routing to preserve the original request path when replacePrefixMatch is not configured [GH-23390]

SECURITY:
- security: upgrade envoy version to 1.35.9 and 1.34.13 [GH-23372]
- security: update google.golang.org/grpc to fix CVE-2026-33186 [GH-23379]
- security: upgrade go version to 1.25.8 [GH-23322]
- security: bump golang.org/x/* dependencies to align with consul-enterprise and address security vulnerabilities. [GH-23322]
IMPROVEMENTS:
- api-gateway: Add support to disable traffic with weight 0 in services for HTTPRoute backends, allowing explicit zero-weight backends to be excluded from traffic. [GH-23216]
- ui: Fixed Consul UI to work in non-secure environments by enabling Ember Data's UUID polyfill for crypto.randomUUID. [GH-23341]
- ui: Fixed Consul UI services page navigation by ensuring route transitions trigger the expected model hook behavior after Ember upgrade. [GH-23271]
- ui: Replaced deprecated SideNav component with AppSideNav for improved navigation structure. [GH-23289]

SECURITY:
- security: upgrade go version to 1.25.7 [GH-23204]
- dockerfile: the Consul build Go base image to alpine3.23 [GH-23194]
- connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
- security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]
- security: Patched Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods. [GH-23249]
- security: Introduced debounce timing for synchronization operations within federationStateAntiEntropySync. [GH-23196]
IMPROVEMENTS:
- api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [GH-23212]
- agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [GH-23202]
- cli: Added --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration [GH-23109]
- docs: Refreshed the security documentation to include the new HTTP server timeout defaults and relevant configuration options. [GH-23246]
- api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [GH-23157]

SECURITY:
- security: upgrade go version to 1.25.7 [GH-23204]
- dockerfile: the Consul build Go base image to alpine3.23 [GH-23194]
- connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
- security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]
IMPROVEMENTS:
- api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [GH-23212]
- agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [GH-23202]
- cli: Added --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration [GH-23109]

SECURITY:
- Update the Consul Build Go base image to alpine3.23.2 [GH-23138]
IMPROVEMENTS:
- api: Add consul services imported-services and new api(/v1/exported-services) command to list services imported by partitions within a local datacenter [GH-12045]
- connect: added ability to configure Virtual IP range for t-proxy with CIDRs [GH-23085]

SECURITY:
- security: Upgrade golang to 1.25.4. [GH-23029]
- security: upgrade internal packages of RHEL builds to include security fixes [GH-23078]
IMPROVEMENTS:
- ui: upgraded Ember framework from v3.28 to v4.12, improving performance and stability. Upgrades multiple other packages which support Ember v4. [GH-23070]
BUG FIXES:
- agent: fix bug prevents default TCP checks from being re-added on service reload when they were explicitly disabled or when custom checks were specified during initial registration. [GH-23088]
- audit-logging: (Enterprise only) Fixed JSON unmarshall error when array of obj is passed for auditReq body. [GH-11546]
- cli: Enhanced error messages in consul config write command to provide actionable guidance when config entries cannot be modified due to references by gateways or routers. [GH-22921]
- mesh: router + splitter + failover with retry now correctly failover for external services failover subsets through terminating gateways. [GH-23092]

SECURITY:
- connect: Upgrade envoy version to 1.35.6 [GH-23056]
- security: Updated golang.org/x/crypto from v0.42.0 to v0.44.0. This resolves GO-2025-4116
IMPROVEMENTS:
- ui: Removed ember-route-action-helper and migrated all {{route-action}} usages to explicit route/controller logic. [GH-23004]
- ui: Replaced reopen() calls with direct property assignment and subclassing to resolve Ember component reopen deprecation warnings [GH-22971]
- ui: removed deprecated Route#renderTemplate usage by introducing DebugLayout component and controller-based conditional rendering for docs routes [GH-22978]
- ui: resolved multiple Ember deprecations:
- Removed mutation-after-consumption warnings in Outlet by staging state updates outside the render pass
- Replaced deprecated Route#replaceWith/transitionTo usage with RouterService in affected routes
- Avoided mutating objects produced by {{hash}} (setting-on-hash) by switching to tracked POJOs [GH-23010]
BUG FIXES:
- acl: fixed a bug where ACL policy replication in WANfed is impacted when primaryDC is inconsistent [GH-22954]
- xds: fix RBAC failure in upstream service when there are more than one downstream exported service with same name but different peer [GH-23049]
- xds: fix bug where Using replacePrefixMatch: "/" results in double slashes (//path) and Using replacePrefixMatch: "" does not strip the prefix at all (e.g., mapping /v1/dashboard → /dashboard) resulting in 301 and 404 errors respectively [GH-23035]

SECURITY:
- connect: Upgrade Consul's bundled Envoy version to 1.35.3 and remove support for 1.31.10. This update also includes a fix to prevent Envoy (v1.35+) startup failures by only configuring the TLS transport socket when the CA bundle is present. [GH-22824]
- security: Adding warning when remote/local script checks are enabled without enabling ACL's [GH-22877]
- security: Improved validation of the Content-Length header in the Consul KV endpoint to prevent potential denial of service attacksCVE-2025-11374 [GH-22916]
- security: adding a maximum Content-Length on the event endpoint to fix denial-of-service (DoS) attacks. This resolves CVE-2025-11375. [GH-22836]
- security: breaking change - adding a key name validation on the key/value endpoint along side with the DisableKVKeyValidation config to disable/enable it to fix path traversal attacks. This resolves CVE-2025-11392. [GH-22850]
FEATURES:
- Added support to register a service in consul with multiple ports [GH-22769]
- agent: Added IsDualStack utility function to detect if the agent is configured for both IPv4 and IPv6 (dual-stack mode) based on its bind address retrieved from "agent/self" API. [GH-22741]
- install: Updated license information displayed during post-install
- ipv6: addtition of ip6tables changes for ipv6 and dual stack support [GH-22787]
- oidc: add client authentication using JWT assertion and PKCE. default PKCE is enabled. [GH-22732]
IMPROVEMENTS:
- security: Upgrade golang to 1.25.3. [GH-22926]
- ui: Fixes computed property override issues currently occurring and in some cases pre-emptively as this has been deprecated in ember v4 [GH-22947]
- ui: removes send action instances as part of https://deprecations.emberjs.com/id/ember-component-send-action/ [GH-22938]
- ui: replaced ember partials with components as an incremental step to upgrade to ember v4 [GH-22888]
- api: Added a new API (/v1/operator/utilization) to support enterprise API for Manual Snapshot Reporting [GH-22837]
- cmd: Added new subcommand consul operator utilization [-today-only] [-message] [-y] to generate a bundle with census utilization snapshot. Main flow is implemented in consul-enterprise
http: Added a new API Handler for /v1/operator/utilization. Core functionality to be implemented in consul-enterprise
agent: Always enabled census metrics collection with configurable option to export it to Hashicorp Reporting [GH-22843]
- cli: snapshot agent now supports authenticating to Azure Blob Storage using Azure Managed Service Identities (MSI). [GH-11171]
- command: connect envoy bootstrap defaults to 127.0.0.1 in IPv4-only environment and to ::1 in IPv6/DualStack environment. [GH-22763]
- connect: default upstream.local_bind_address to ::1 for IPv6 agent bind address [GH-22773]
- proxy: default proxy.local_service_address to ::1 for IPv6 agent bind address [GH-22772]
- ui: Improved accessibility features in the Consul UI to enhance usability for users with disabilities [GH-22770]
- ui: Replace yarn with pnpm for package management [GH-22790]
- ui: auth method config values were overflowing. This PR fixes the issue and adds word break for table elements with large content. [GH-22813]
BUG FIXES:
- ui: Allow FQDN to be displayed in the Consul web interface. [GH-22779]
- ui: fixes the issue where namespaces where disappearing and Welcome to Namespace screen showed up after tab switching [GH-22789]
- ui: fixes the issue where when doing deletes of multiple tokens or policies, the three dots on the right hand side stops responding after the first delete. [GH-22752]
- cmd: Fix consul operator utilization --help to show only available options without extra parameters. [GH-22912]

SECURITY:
- Migrate transitive dependency from archived mitchellh/mapstructure to go-viper/mapstructure to v2 to address CVE-2025-52893. [GH-22581]
- agent: Add the KV Validations to block path traversal allowing access to unauthorized endpoints. [GH-22682]
- agent: Fix a security vulnerability to filter out anonymous tokens along with empty tokens when setting the Results-Filtered-By-ACLs header [GH-22534]
- agent: Fix a security vulnerability where the attacker could read agent’s TLS certificate and private key by using the group ID that the Consul agent runs as. [GH-22626]
- api: add charset in all applicable content-types. [GH-22598]
- connect: Upgrade envoy version to 1.34.7 [GH-22735]
- security: Fix GHSA-65rg-554r-9j5x (CVE-2024-48908) by upgrading lycheeverse/lychee-action. [GH-22667]
- security: Fix a security vulnerability where the attacker could bypass authentication by passing url params as there was no validation on them. [GH-22612]
- security: perform constant time compare for sensitive values. [GH-22537]
- security: upgrade go version to 1.25.0 [GH-22652]
- security:: (Enterprise only) fix nil pointer dereference.
- security:: (Enterprise only) fix potential race condition in partition CRUD.
- security:: (Enterprise only) perform constant time compare for sensitive values.
FEATURES:
- config: Add new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream [GH-22604]
- config: Handle a new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream in API Gateway config and proxy-defaults [GH-22679]
- config: Handle a new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Mesh Gateway via service-defaults and proxy-defaults [GH-22722]
- config: Handle a new parameter max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Terminating Gateway service-defaults and proxy-defaults [GH-22680]
IMPROVEMENTS:
- cli: add troubleshoot ports in debug command. A ports.json file is created, which lists the open or closed ports on the host where the command is executed. [GH-22624]
BUG FIXES:
- agent: Don't show admin partition during errors [GH-11154]

SECURITY:
- security: Update Go to 1.23.12 to address CVE-2025-47906 [GH-22547]
IMPROVEMENTS:
- ui: Replaced internal code editor with HDS (HashiCorp Design System) code editor and code block components for improved accessibility and maintainability across the Consul UI. [GH-22513]
BUG FIXES:
- cli: capture pprof when ACL is enabled and a token with operator:read is used, even if enable_debug config is not explicitly set. [GH-22552]

IMPROVEMENTS:
- ui: Improved display and handling of IPv6 addresses for better readability and usability in the Consul web interface. [GH-22468]
BUG FIXES:
- cli: validate IP address in service registration to prevent invalid IPs in service and tagged addresses. [GH-22467]
- ui: display IPv6 addresses with proper bracketed formatting [GH-22423]

SECURITY:
- security: Upgrade UBI base image version to address CVE
CVE-2025-4802
CVE-2024-40896
CVE-2024-12243
CVE-2025-24528
CVE-2025-3277
CVE-2024-12133
CVE-2024-57970
CVE-2025-31115 [GH-22409]
- cli: update tls ca and cert create to reduce excessive file perms for generated public files [GH-22286]
- connect: Added non default namespace and partition checks to ConnectCA CSR requests. [GH-22376]
- security: Upgrade Go to 1.23.10. [GH-22412]
IMPROVEMENTS:
- config: Warn about invalid characters in datacenter resulting in non-generation of X.509 certificates when using external CA for agent TLS communication. [GH-22382]
- connect: Use net.JoinHostPort for host:port formatting to handle IPv6. [GH-22359]
BUG FIXES:
- http: return a clear error when both Service.Service and Service.ID are missing during catalog registration [GH-22381]
- license: (Enterprise only) Fixed issue where usage metrics are not written to the snapshot to export the license data. [GH-10668]
- wan-federation: Fixed an issue where advertised IPv6 addresses were causing WAN federation to fail. [GH-22226]

FEATURES:
- xds: Extend LUA Script support for API Gateway [GH-22321]
- xds: Added a configurable option to disable XDS session load balancing, intended for scenarios where an external load balancer is used in front of Consul servers, making internal load balancing unnecessary.
IMPROVEMENTS:
- http: Add peer query param on catalog service API [GH-22189]

FEATURES:
- config: add UseSNI flag in remote JSONWebKeySet
agent: send TLS SNI in remote JSONWebKeySet [GH-22177]
- v2: remove HCP Link integration [GH-21883]
IMPROVEMENTS:
- raft: add a configuration raft_prevote_disabled to allow disabling raft prevote [GH-21758]
- raft: update raft library to 1.7.0 which include pre-vote extension [GH-21758]
- SubMatView: Log level change from ERROR to INFO for subject materialized view as subscription creation is retryable on ACL change. [GH-22141]
- ui: Adds a copyable token accessor/secret on the settings page when signed in [GH-22105]
- xDS: Log level change from ERROR to INFO for xDS delta discovery request. Stream can be cancelled on server shutdown and other scenarios. It is retryable and error is a superfluous log. [GH-22141]

SECURITY:
- Update golang.org/x/net to v0.38.0 to address GHSA-vvgc-356p-c3xw and GO-2025-3595.
Update github.com/golang-jwt/jwt/v4 to v4.5.2 to address GO-2025-3553 and GHSA-mh63-6h87-95cp.
Update Go to v1.23.8 to address GO-2025-3563. [GH-22268]
IMPROVEMENTS:
- Added support for Consul Session to update the state of a Health Check, allowing for more dynamic and responsive health monitoring within the Consul ecosystem. This feature enables sessions to directly influence health check statuses, improving the overall reliability and accuracy of service health assessments. [GH-22227]
BUG FIXES:
- agent: Add the missing Service TaggedAddresses and Check Type fields to Txn API. [GH-22220]