Baixar HashiCorp Consul 2.0.3 per a Windows

SECURITY:
- Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786]
- Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786]
- Update golang.org/x/text to v0.39.0 to address GO-2026-5970. [GH-23761]
- Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf. [GH-23761]
- Update socket.io-parser to address CVE-2026-69185 (Zero-attachment Memory Exhaustion). [GH-23786]
- Upgrade to use Go 1.26.5. This resolves vulnerabilities
GO-2026-4970 (os).
GO-2026-5856 (crypto/tls). [GH-23761]
- agent: Fixed a denial-of-service vulnerability where GET /v1/agent/connect/ca/roots
and POST /v1/agent/connect/authorize used the agent-side cache unconditionally, even
when http_config { use_cache = false } was configured by the operator. A remote caller
could bypass this setting and grow the agent cache without bound by varying the request
ACL token. Both endpoints now skip the cache and issue a direct RPC when use_cache is
disabled. (SECVULN-50292, SECVULN-50293) [GH-23797]
- agent: Fixed a nil-pointer dereference panic in ShadowServiceRouterConfigEntry.CheckEnt
when a service-router config entry contained a route with a nil Destination. A crafted
snapshot restore or replication message containing such an entry could crash the FSM
decode path. The nil guard now treats a missing destination as non-enterprise data and
continues decoding safely. (SECVULN-50291) [GH-23797]
- agent: Fixed a security bypass where a user-supplied public listener
(envoy_public_listener_json) with an HTTP Connection Manager filter would skip Consul's
inbound request-normalization defaults. An attacker could exploit the un-normalized path
to bypass L7 intention deny rules using percent-encoded path equivalents. Consul now
injects path normalization (enabled by default, unless the mesh config option
InsecureDisablePathNormalization is set) on every HCM filter chain in user-provided
public listeners before L7 intention enforcement is applied. (SECVULN-50295) [GH-23797]
- agent: Fixed an unauthenticated denial-of-service vulnerability where
PUT /v1/agent/check/update/:id, PUT /v1/agent/check/register,
PUT /v1/agent/service/register, and POST /v1/agent/connect/authorize
decoded unbounded JSON request bodies before resolving the caller's ACL
token. An unauthenticated caller could retain multiple large JSON decoder
buffers concurrently inside the Consul process before each request was
rejected with HTTP 403, causing attacker-controlled heap growth. All four
endpoints now cap the request body at 512 KiB before any decoding occurs,
returning HTTP 413 for oversized bodies. This limit applies to chunked
transfer encoding as well as declared Content-Length.
(SECVULN-50418) [GH-23796]
- agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC
and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP
before any request processing, ACL check, or rate limiting could occur. A remote attacker
could exhaust agent file descriptors, goroutines, and memory by opening many connections
and withholding the gRPC or TLS handshake. A new per-client-IP connection limiter is now
applied before the gRPC server observes the connection, controlled by the new
limits.grpc_max_conns_per_client configuration option (default 100). The gRPC handshake
timeout has also been reduced from the library default of 120 seconds to 20 seconds.
(SECVULN-50294) [GH-23797]
IMPROVEMENTS:
- ui: migrate yadda/Gherkin acceptance tests to native QUnit (harness, intentions/create, components, settings) [GH-23741]
- xds: Add two new opt-in ProxyDefaults.spec.config keys for controlling the server response header on API Gateway HTTP listeners: envoy_suppress_envoy_headers (removes the header entirely) and envoy_server_header_name (renames it to a custom value). If both are set, suppress takes precedence. [GH-13027]
BUG FIXES:
- agent: Stop logging the raw ACL token in debug-level content-type logs. [GH-23731]
- api-gateway: Fixed a regression that caused an HTTP API gateway to reject its configuration with an "inconsistent protocols" error (resulting in intermittent 503s) when a backend service's service-router composed a route to a destination in a different service, namespace, or partition during discovery-chain synthesis. [GH-23793]
- serf: Fix WAN flood-join to ignore non-alive destination members (leaving/left/failed), allowing rejoined servers to heal back to alive in WAN membership. [GH-23709]
- xds: Addition of XFCC headers to GPRC request similar to HTTP request for connect-proxy inbound listener [GH-23744]