v1.13.1

1.13.1

March 29, 2023

IMPROVEMENTS:

• auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
  website/docs: Add docs for VAULT_AUTH_CONFIG_GITHUB_TOKEN environment variable when writing Github config [GH-19244]
• core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed. It's being added as a last-ditch
  option in case all else fails for some replication issues we may not have fully reproduced. [GH-19676]
• core: validate name identifiers in mssql physical storage backend prior use [GH-19591]
• database/elasticsearch: Update error messages resulting from Elasticsearch API errors [GH-19545]
• events: Suppress log warnings triggered when events are sent but the events system is not enabled. [GH-19593]

BUG FIXES:

• agent: Fix panic when SIGHUP is issued to Agent while it has a non-TLS listener. [GH-19483]
• core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
• core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [GH-19585]
• kmip (enterprise): Do not require attribute Cryptographic Usage Mask when registering Secret Data managed objects.
• kmip (enterprise): Fix a problem forwarding some requests to the active node.
• openapi: Fix logic for labeling unauthenticated/sudo paths. [GH-19600]
• secrets/ldap: Invalidates WAL entry for static role if password_policy has changed. [GH-19640]
• secrets/pki: Fix PKI revocation request forwarding from standby nodes due to an error wrapping bug [GH-19624]
• secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
• ui: Fixes crypto.randomUUID error in unsecure contexts from third party ember-data library [GH-19428]
• ui: fixes SSH engine config deletion [GH-19448]
• ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [GH-19703]
• ui: fixes oidc tabs in auth form submitting with the root's default_role value after a namespace has been inputted [GH-19541]
• ui: pass encodeBase64 param to HMAC transit-key-actions. [GH-19429]
• ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [GH-19460]

v1.12.5

1.12.5

March 29, 2023

IMPROVEMENTS:

• auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
  website/docs: Add docs for VAULT_AUTH_CONFIG_GITHUB_TOKEN environment variable when writing Github config [GH-19244]
• core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed. It's being added as a last-ditch
  option in case all else fails for some replication issues we may not have fully reproduced. [GH-19676]
• core: validate name identifiers in mssql physical storage backend prior use [GH-19591]

BUG FIXES:

• cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [GH-17913]
• core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
• core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [GH-19585]
• kmip (enterprise): Do not require attribute Cryptographic Usage Mask when registering Secret Data managed objects.
• kmip (enterprise): Fix a problem forwarding some requests to the active node.
• openapi: Fix logic for labeling unauthenticated/sudo paths. [GH-19600]
• secrets/ldap: Invalidates WAL entry for static role if password_policy has changed. [GH-19641]
• secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
• ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [GH-19703]
• ui: pass encodeBase64 param to HMAC transit-key-actions. [GH-19429]
• ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [GH-19460]

v1.11.9

1.11.9

March 29, 2023

IMPROVEMENTS:

• auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
  website/docs: Add docs for VAULT_AUTH_CONFIG_GITHUB_TOKEN environment variable when writing Github config [GH-19244]
• core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed. It's being added as a last-ditch
  option in case all else fails for some replication issues we may not have fully reproduced. [GH-19676]
• core: validate name identifiers in mssql physical storage backend prior use [GH-19591]

BUG FIXES:

• auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [#190] [GH-19720]
• cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [GH-17913]
• core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
• core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [GH-19585]
• openapi: Fix logic for labeling unauthenticated/sudo paths. [GH-19600]
• secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
• ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [GH-19703]
• ui: pass encodeBase64 param to HMAC transit-key-actions. [GH-19429]
• ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [GH-19460]

v1.13.0

1.13.0

March 01, 2023

SECURITY:

• secrets/ssh: removal of the deprecated dynamic keys mode. When any remaining dynamic key leases expire, an error stating secret is unsupported by this backend will be thrown by the lease manager. [GH-18874]

CHANGES:

• auth/alicloud: require the role field on login [GH-19005]
• auth/approle: Add maximum length of 4096 for approle role_names, as this value results in HMAC calculation [GH-17768]
• auth: Returns invalid credentials for ldap, userpass and approle when wrong credentials are provided for existent users.
  This will only be used internally for implementing user lockout. [GH-17104]
• core: Bump Go version to 1.20.1.
• core: Vault version has been moved out of sdk and into main vault module.
  Plugins using sdk/useragent.String must instead use sdk/useragent.PluginString. [GH-14229]
• logging: Removed legacy environment variable for log format ('LOGXI_FORMAT'), should use 'VAULT_LOG_FORMAT' instead [GH-17822]
• plugins: Mounts can no longer be pinned to a specific builtin version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without builtin in their metadata remain unaffected. [GH-18051]
• plugins: GET /database/config/:name endpoint now returns an additional plugin_version field in the response data. [GH-16982]
• plugins: GET /sys/auth/:path/tune and GET /sys/mounts/:path/tune endpoints may now return an additional plugin_version field in the response data if set. [GH-17167]
• plugins: GET for /sys/auth, /sys/auth/:path, /sys/mounts, and /sys/mounts/:path paths now return additional plugin_version, running_plugin_version and running_sha256 fields in the response data for each mount. [GH-17167]
• sdk: Remove version package, make useragent.String versionless. [GH-19068]
• secrets/aws: do not create leases for non-renewable/non-revocable STS credentials to reduce storage calls [GH-15869]
• secrets/gcpkms: Updated plugin from v0.13.0 to v0.14.0 [GH-19063]
• sys/internal/inspect: Turns of this endpoint by default. A SIGHUP can now be used to reload the configs and turns this endpoint on.
• ui: Upgrade Ember to version 4.4.0 [GH-17086]

FEATURES:

• Azure Auth Managed Identities: Allow any Azure resource that supports managed identities to authenticate with Vault [GH-19077]
• Azure Auth Rotate Root: Add support for rotate root in Azure Auth engine [GH-19077]
• Event System (Alpha): Vault has a new opt-in experimental event system. Not yet suitable for production use. Events are currently only generated on writes to the KV secrets engine, but external plugins can also be updated to start generating events. [GH-19194]
• GCP Secrets Impersonated Account Support: Add support for GCP service account impersonation, allowing callers to generate a GCP access token without requiring Vault to store or retrieve a GCP service account key for each role. [GH-19018]
• Kubernetes Secrets Engine UI: Kubernetes is now available in the UI as a supported secrets engine. [GH-17893]
• New PKI UI: Add beta support for new and improved PKI UI [GH-18842]
• PKI Cross-Cluster Revocations: Revocation information can now be
  synchronized across primary and performance replica clusters offering
  a unified CRL/OCSP view of revocations across cluster boundaries. [GH-19196]
• Server UDS Listener: Adding listener to Vault server to serve http request via unix domain socket [GH-18227]
• Transit managed keys: The transit secrets engine now supports configuring and using managed keys
• User Lockout: Adds support to configure the user-lockout behaviour for failed logins to prevent
  brute force attacks for userpass, approle and ldap auth methods. [GH-19230]
• VMSS Flex Authentication: Adds support for Virtual Machine Scale Set Flex Authentication [GH-19077]
• Namespaces (enterprise): Added the ability to allow access to secrets and more to be shared across namespaces that do not share a namespace hierarchy. Using the new sys/config/group-policy-application API, policies can be configured to apply outside of namespace hierarchy, allowing this kind of cross-namespace sharing.
• OpenAPI-based Go & .NET Client Libraries (Beta): We have now made available two new OpenAPI-based Go & .NET Client libraries (beta). You can use them to perform various secret management operations easily from your applications.

IMPROVEMENTS:

• Redis ElastiCache DB Engine: Renamed configuration parameters for disambiguation; old parameters still supported for compatibility. [GH-18752]
• Bump github.com/hashicorp/go-plugin version from 1.4.5 to 1.4.8 [GH-19100]
• Reduced binary size [GH-17678]
• agent/config: Allow config directories to be specified with -config, and allow multiple -configs to be supplied. [GH-18403]
• agent: Add note in logs when starting Vault Agent indicating if the version differs to the Vault Server. [GH-18684]
• agent: Added token_file auto-auth configuration to allow using a pre-existing token for Vault Agent. [GH-18740]
• agent: Agent listeners can now be to be the metrics_only role, serving only metrics, as part of the listener's new top level role option. [GH-18101]
• agent: Configured Vault Agent listeners now listen without the need for caching to be configured. [GH-18137]
• agent: allows some parts of config to be reloaded without requiring a restart. [GH-18638]
• agent: fix incorrectly used loop variables in parallel tests and when finalizing seals [GH-16872]
• api: Remove dependency on sdk module. [GH-18962]
• api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [GH-17352]
• audit: Add elide_list_responses option, providing a countermeasure for a common source of oversized audit log entries [GH-18128]
• audit: Include stack trace when audit logging recovers from a panic. [GH-18121]
• auth/alicloud: upgrades dependencies [GH-18021]
• auth/azure: Adds support for authentication with Managed Service Identity (MSI) from a
  Virtual Machine Scale Set (VMSS) in flexible orchestration mode. [GH-17540]
• auth/azure: upgrades dependencies [GH-17857]
• auth/cert: Add configurable support for validating client certs with OCSP. [GH-17093]
• auth/cert: Support listing provisioned CRLs within the mount. [GH-18043]
• auth/cf: Remove incorrect usage of CreateOperation from path_config [GH-19098]
• auth/gcp: Upgrades dependencies [GH-17858]
• auth/oidc: Adds abort_on_error parameter to CLI login command to help in non-interactive contexts [GH-19076]
• auth/oidc: Adds ability to set Google Workspace domain for groups search [GH-19076]
• auth/token (enterprise): Allow batch token creation in perfStandby nodes
• auth: Allow naming login MFA methods and using those names instead of IDs in satisfying MFA requirement for requests.
  Make passcode arguments consistent across login MFA method types. [GH-18610]
• auth: Provide an IP address of the requests from Vault to a Duo challenge after successful authentication. [GH-18811]
• autopilot: Update version to v.0.2.0 to add better support for respecting min quorum
• cli/kv: improve kv CLI to remove data or custom metadata using kv patch [GH-18067]
• cli/pki: Add List-Intermedi...

v1.12.4

1.12.4

March 01, 2023

CHANGES:

• core: Bump Go version to 1.19.6.

IMPROVEMENTS:

• secrets/database: Adds error message requiring password on root crednetial rotation. [GH-19103]
• ui: remove wizard [GH-19220]

BUG FIXES:

• auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [GH-19186]
• core (enterprise): Fix panic when using invalid accessor for control-group request
• core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
• core: Prevent panics in sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]
• license (enterprise): Fix bug where license would update even if the license didn't change.
• replication (enterprise): Fix bug where reloading external plugin on a secondary would
  break replication.
• secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [GH-18207]
• secrets/pki: Revert fix for PR 18938 [GH-19037]
• server/config: Use file.Stat when checking file permissions when VAULT_ENABLE_FILE_PERMISSIONS_CHECK is enabled [GH-19311]
• ui (enterprise): Fix cancel button from transform engine role creation page [GH-19135]
• ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [GH-19071]
• ui: fixes reliance on secure context (https) by removing methods using the Crypto interface [GH-19410]
• ui: show Get credentials button for static roles detail page when a user has the proper permissions. [GH-19190]

v1.11.8

1.11.8

March 01, 2023

CHANGES:

• core: Bump Go version to 1.19.6.

IMPROVEMENTS:

• secrets/database: Adds error message requiring password on root crednetial rotation. [GH-19103]

BUG FIXES:

• auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [GH-19186]
• core (enterprise): Fix panic when using invalid accessor for control-group request
• core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
• core: Prevent panics in sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]
• license (enterprise): Fix bug where license would update even if the license didn't change.
• replication (enterprise): Fix bug where reloading external plugin on a secondary would
  break replication.
• secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [GH-18208]
• ui (enterprise): Fix cancel button from transform engine role creation page [GH-19135]
• ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [GH-19071]
• ui: show Get credentials button for static roles detail page when a user has the proper permissions. [GH-19190]

v1.10.11

1.10.11

March 01, 2023

CHANGES:

• core: Bump Go version to 1.19.6.

IMPROVEMENTS:

• secrets/database: Adds error message requiring password on root crednetial rotation. [GH-19103]

BUG FIXES:

• auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [GH-19186]
• core (enterprise): Fix panic when using invalid accessor for control-group request
• core: Prevent panics in sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]
• replication (enterprise): Fix bug where reloading external plugin on a secondary would
  break replication.
• secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [GH-18209]
• ui (enterprise): Fix cancel button from transform engine role creation page [GH-19135]
• ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [GH-19071]

v1.13.0-rc1

February 16, 2023

SECURITY:

• secrets/ssh: removal of the deprecated dynamic keys mode. When any remaining dynamic key leases expire, an error stating secret is unsupported by this backend will be thrown by the lease manager. [GH-18874]

CHANGES:

• auth/alicloud: require the role field on login [GH-19005]
• auth/approle: Add maximum length of 4096 for approle role_names, as this value results in HMAC calculation [GH-17768]
• auth: Returns invalid credentials for ldap, userpass and approle when wrong credentials are provided for existent users. This will only be used internally for implementing user lockout. [GH-17104]
• core: Bump Go version to 1.20.
• core: Vault version has been moved out of sdk and into main vault module. Plugins using sdk/useragent.String must instead use sdk/useragent.PluginString. [GH-14229]
• logging: Removed legacy environment variable for log format ('LOGXI_FORMAT'), should use 'VAULT_LOG_FORMAT' instead [GH-17822]
• plugins: Mounts can no longer be pinned to a specific builtin version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without builtin in their metadata remain unaffected. [GH-18051]
• plugins: GET /database/config/:name endpoint now returns an additional plugin_version field in the response data. [GH-16982]
• plugins: GET /sys/auth/:path/tune and GET /sys/mounts/:path/tune endpoints may now return an additional plugin_version field in the response data if set. [GH-17167]
• plugins: GET for /sys/auth, /sys/auth/:path, /sys/mounts, and /sys/mounts/:path paths now return additional plugin_version, running_plugin_version and running_sha256 fields in the response data for each mount. [GH-17167]
• sdk: Remove version package, make useragent.String versionless. [GH-19068]
• secrets/aws: do not create leases for non-renewable/non-revocable STS credentials to reduce storage calls [GH-15869]
• secrets/gcpkms: Updated plugin from v0.13.0 to v0.14.0 [GH-19063]
• sys/internal/inspect: Turns of this endpoint by default. A SIGHUP can now be used to reload the configs and turns this endpoint on.
• ui: Upgrade Ember to version 4.4.0 [GH-17086]

FEATURES:

• Azure Auth Managed Identities: Allow any Azure resource that supports managed identities to authenticate with Vault [GH-19077]
• Azure Auth Rotate Root: Add support for rotate root in Azure Auth engine [GH-19077]
• Kubernetes Secrets Engine UI: Kubernetes is now available in the UI as a supported secrets engine. [GH-17893]
• New PKI UI: Add beta support for new and improved PKI UI [GH-18842]
• Server UDS Listener: Adding listener to Vault server to serve http request via unix domain socket [GH-18227]
• Transit managed keys: The transit secrets engine now supports configuring and using managed keys
• VMSS Flex Authentication: Adds support for Virtual Machine Scale Set Flex Authentication [GH-19077]

IMPROVEMENTS:

• Redis ElastiCache DB Engine: Renamed configuration parameters for disambiguation; old parameters still supported for compatibility. [GH-18752]
• Bump github.com/hashicorp/go-plugin version from 1.4.5 to 1.4.8 [GH-19100]
• Reduced binary size [GH-17678]
• agent/config: Allow config directories to be specified with -config, and allow multiple -configs to be supplied. [GH-18403]
• agent: Add note in logs when starting Vault Agent indicating if the version differs to the Vault Server. [GH-18684]
• agent: Added token_file auto-auth configuration to allow using a pre-existing token for Vault Agent. [GH-18740]
• agent: Agent listeners can now be to be the metrics_only role, serving only metrics, as part of the listener's new top level role option. [GH-18101]
• agent: Configured Vault Agent listeners now listen without the need for caching to be configured. [GH-18137]
• agent: allows some parts of config to be reloaded without requiring a restart. [GH-18638]
• agent: fix incorrectly used loop variables in parallel tests and when finalizing seals [GH-16872]
• api: Remove dependency on sdk module. [GH-18962]
• api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [GH-17352]
• audit: Add elide_list_responses option, providing a countermeasure for a common source of oversized audit log entries [GH-18128]
• audit: Include stack trace when audit logging recovers from a panic. [GH-18121]
• auth/alicloud: upgrades dependencies [GH-18021]
• auth/azure: Adds support for authentication with Managed Service Identity (MSI) from a Virtual Machine Scale Set (VMSS) in flexible orchestration mode. [GH-17540]
• auth/azure: upgrades dependencies [GH-17857]
• auth/cert: Add configurable support for validating client certs with OCSP. [GH-17093]
• auth/cert: Support listing provisioned CRLs within the mount. [GH-18043]
• auth/cf: Remove incorrect usage of CreateOperation from path_config [GH-19098]
• auth/gcp: Upgrades dependencies [GH-17858]
• auth/oidc: Adds abort_on_error parameter to CLI login command to help in non-interactive contexts [GH-19076]
• auth/oidc: Adds ability to set Google Workspace domain for groups search [GH-19076]
• auth/token (enterprise): Allow batch token creation in perfStandby nodes
• auth: Allow naming login MFA methods and using those names instead of IDs in satisfying MFA requirement for requests. Make passcode arguments consistent across login MFA method types. [GH-18610]
• auth: Provide an IP address of the requests from Vault to a Duo challenge after successful authentication. [GH-18811]
• autopilot: Update version to v.0.2.0 to add better support for respecting min quorum [GH-17848]
• autopilot: Update version to v.0.2.0 to add better support for respecting min quorum
• cli/kv: improve kv CLI to remove data or custom metadata using kv patch [GH-18067]
• cli/pki: Add List-Intermediates functionality to pki client. [GH-18463]
• cli/pki: Add health-check subcommand to evaluate the health of a PKI instance. [GH-17750]
• cli/pki: Add pki issue command, which creates a CSR, has a vault mount sign it, then reimports it. [GH-18467]
• cli: Add support for creating requests to existing non-KVv2 PATCH-capable endpoints. [GH-17650]
• cli: Add transit import key helper commands for BYOK to Transit/Transform. [GH-18887]
• cli: Support the -format=raw option, to read non-JSON Vault endpoints and original response bodies. [GH-14945]
• cli: updated vault operator rekey prompts to describe recovery keys when -target=recovery [GH-18892]
• client/pki: Add a new command verify-sign which checks the relationship between two certificates. [GH-18437]
• command/server: Environment variable keys are now logged at startup. [GH-18125]
• core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
• core/identity: Add machine-readable output to body of response upon alias clash during entity merge [...

v1.12.3

1.12.3

February 6, 2023

CHANGES:

• core: Bump Go version to 1.19.4.

IMPROVEMENTS:

• audit: Include stack trace when audit logging recovers from a panic. [GH-18121]
• command/server: Environment variable keys are now logged at startup. [GH-18125]
• core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
• core: Add read support to sys/loggers and sys/loggers/:name endpoints [GH-17979]
• plugins: Let Vault unseal and mount deprecated builtin plugins in a
  deactivated state if this is not the first unseal after an upgrade. [GH-17879]
• secrets/db/mysql: Add tls_server_name and tls_skip_verify parameters [GH-18799]
• secrets/kv: new KVv2 mounts and KVv1 mounts without any keys will upgrade synchronously, allowing for instant use [GH-17406]
• storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [GH-12166]
• ui: Added JWT authentication warning message about blocked pop-up windows and web browser settings. [GH-18787]
• ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [GH-18342]
• ui: Update language on database role to "Connection name" [GH-18261] [GH-18350]

BUG FIXES:

• auth/approle: Fix token_bound_cidrs validation when using /32 blocks for role and secret ID [GH-18145]
• auth/cert: Address a race condition accessing the loaded crls without a lock [GH-18945]
• auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [#173] [GH-18716]
• cli/kv: skip formatting of nil secrets for patch and put with field parameter set [GH-18163]
• command/namespace: Fix vault cli namespace patch examples in help text. [GH-18143]
• core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
• core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
• core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
• core/quotas: Fix issue with improper application of default rate limit quota exempt paths [GH-18273]
• core/seal: Fix regression handling of the key_id parameter in seal configuration HCL. [GH-17612]
• core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
• core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [GH-18923]
• database/mongodb: Fix writeConcern set to be applied to any query made on the database [GH-18546]
• expiration: Prevent panics on perf standbys when an irrevocable release gets deleted. [GH-18401]
• kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
• kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
• kmip (enterprise): Fix Query operation response that omitted streaming capability and supported profiles.
• licensing (enterprise): update autoloaded license cache after reload
• plugins: Allow running external plugins which override deprecated builtins. [GH-17879]
• plugins: Listing all plugins while audit logging is enabled will no longer result in an internal server error. [GH-18173]
• plugins: Skip loading but still mount data associated with missing plugins on unseal. [GH-18189]
• sdk: Don't panic if system view or storage methods called during plugin setup. [GH-18210]
• secrets/pki: Address nil panic when an empty POST request is sent to the OCSP handler [GH-18184]
• secrets/pki: Allow patching issuer to set an empty issuer name. [GH-18466]
• secrets/pki: OCSP GET request parameter was not being URL unescaped before processing. [GH-18938]
• secrets/pki: fix race between tidy's cert counting and tidy status reporting. [GH-18899]
• secrets/transit: Do not warn about unrecognized parameter 'batch_input' [GH-18299]
• secrets/transit: Honor partial_success_response_code on decryption failures. [GH-18310]
• storage/raft (enterprise): An already joined node can rejoin by wiping storage
  and re-issueing a join request, but in doing so could transiently become a
  non-voter. In some scenarios this resulted in loss of quorum. [GH-18263]
• storage/raft: Don't panic on unknown raft ops [GH-17732]
• ui: cleanup unsaved auth method ember data record when navigating away from mount backend form [GH-18651]
• ui: fixes query parameters not passed in api explorer test requests [GH-18743]

v1.11.7

1.11.7

February 6, 2023

CHANGES:

• core: Bump Go version to 1.19.4.

IMPROVEMENTS:

• command/server: Environment variable keys are now logged at startup. [GH-18125]
• core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
• secrets/db/mysql: Add tls_server_name and tls_skip_verify parameters [GH-18799]
• ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [GH-18342]
• ui: Update language on database role to "Connection name" [GH-18261] [GH-18350]

BUG FIXES:

• auth/approle: Fix token_bound_cidrs validation when using /32 blocks for role and secret ID [GH-18145]
• cli/kv: skip formatting of nil secrets for patch and put with field parameter set [GH-18163]
• core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
• core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
• core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
• core/quotas: Fix issue with improper application of default rate limit quota exempt paths [GH-18273]
• core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
• core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [GH-18923]
• database/mongodb: Fix writeConcern set to be applied to any query made on the database [GH-18546]
• identity (enterprise): Fix a data race when creating an entity for a local alias.
• kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
• kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
• kmip (enterprise): Fix Query operation response that omitted streaming capability and supported profiles.
• licensing (enterprise): update autoloaded license cache after reload
• secrets/pki: Allow patching issuer to set an empty issuer name. [GH-18466]
• secrets/transit: Do not warn about unrecognized parameter 'batch_input' [GH-18299]
• storage/raft (enterprise): An already joined node can rejoin by wiping storage
  and re-issueing a join request, but in doing so could transiently become a
  non-voter. In some scenarios this resulted in loss of quorum. [GH-18263]
• storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
• storage/raft: Don't panic on unknown raft ops [GH-17732]
• ui: fixes query parameters not passed in api explorer test requests [GH-18743]