Sourced fromgithub.com/hashicorp/consul/api's changelog.

1.22.0 Enterprise (October 24, 2025)

SECURITY:

• connect: Upgrade Consul's bundled Envoy version to 1.35.3 and remove support for 1.31.10. This update also includes a fix to prevent Envoy (v1.35+) startup failures by only configuring the TLS transport socket when the CA bundle is present. [GH-22824]
• security: Adding warning when remote/local script checks are enabled without enabling ACL's [GH-22877]
• security: Improved validation of the Content-Length header in the Consul KV endpoint to prevent potential denial of service attacksCVE-2025-11374 [GH-22916]
• security: adding a maximum Content-Length on the event endpoint to fix denial-of-service (DoS) attacks. This resolvesCVE-2025-11375. [GH-22836]
• security: breaking change - adding a key name validation on the key/value endpoint along side with the DisableKVKeyValidation config to disable/enable it to fix path traversal attacks on misconfigured or missing ACL policies. [GH-22850]

FEATURES:

• Added support to register a service in consul with multiple ports [GH-22769]
• agent: Added IsDualStack utility function to detect if the agent is configured for both IPv4 and IPv6 (dual-stack mode) based on its bind address retrieved from "agent/self" API. [GH-22741]
• install: Updated license information displayed during post-install
• ipv6: addtition of ip6tables changes for ipv6 and dual stack support [GH-22787]
• oidc: add client authentication using JWT assertion and PKCE. default PKCE is enabled. [GH-22732]

IMPROVEMENTS:

• security: Upgrade golang to 1.25.3. [GH-22926]
• ui: Fixes computed property override issues currently occurring and in some cases pre-emptively as this has been deprecated in ember v4 [GH-22947]
• ui: removes send action instances as part ofhttps://deprecations.emberjs.com/id/ember-component-send-action/ [GH-22938]
• ui: replaced ember partials with components as an incremental step to upgrade to ember v4 [GH-22888]
• api: Added a new API (/v1/operator/utilization) to support enterprise API for Manual Snapshot Reporting [GH-22837]
• cmd: Added new subcommandconsul operator utilization [-today-only] [-message] [-y] to generate a bundle with census utilization snapshot. Main flow is implemented in consul-enterprisehttp: Added a new API Handler for/v1/operator/utilization. Core functionality to be implemented in consul-enterpriseagent: Always enabled census metrics collection with configurable option to export it to Hashicorp Reporting [GH-22843]
• cli:snapshot agent now supports authenticating to Azure Blob Storage using Azure Managed Service Identities (MSI). [GH-11171]
• command: connect envoy bootstrap defaults to 127.0.0.1 in IPv4-only environment and to ::1 in IPv6/DualStack environment. [GH-22763]
• connect: default upstream.local_bind_address to ::1 for IPv6 agent bind address [GH-22773]
• proxy: default proxy.local_service_address to ::1 for IPv6 agent bind address [GH-22772]
• ui: Improved accessibility features in the Consul UI to enhance usability for users with disabilities [GH-22770]
• ui: Replace yarn with pnpm for package management [GH-22790]
• ui: auth method config values were overflowing. This PR fixes the issue and adds word break for table elements with large content. [GH-22813]

BUG FIXES:

• ui: Allow FQDN to be displayed in the Consul web interface. [GH-22779]
• ui: fixes the issue where namespaces where disappearing and Welcome to Namespace screen showed up after tab switching [GH-22789]
• ui: fixes the issue where when doing deletes of multiple tokens or policies, the three dots on the right hand side stops responding after the first delete. [GH-22752]
• cmd: Fixconsul operator utilization --help to show only available options without extra parameters. [GH-22912]

1.22.0 (October 24, 2025)

SECURITY:

• connect: Upgrade Consul's bundled Envoy version to 1.35.3 and remove support for 1.31.10. This update also includes a fix to prevent Envoy (v1.35+) startup failures by only configuring the TLS transport socket when the CA bundle is present. [GH-22824]
• security: Adding warning when remote/local script checks are enabled without enabling ACL's [GH-22877]
• security: Improved validation of the Content-Length header in the Consul KV endpoint to prevent potential denial of service attacksCVE-2025-11374 [GH-22916]

... (truncated)

• 1a47ec5 submodule version update
• 5d2aa72 post release changes (#22950) (#22980)
• c0922f9 Backport of [UI] replace direct use of transitionTo with router service's tra...
• f7c80bc Backport of upgrade: logrus to v1.9.3 into release/1.22.x (#22974)
• 5efc188 Backport of upgrade golang to latest patch into release/1.22.x (#22968)
• 36140dc Backport of upgrades ember-collection into release/1.22.x (#22966)
• 504ec51 [UI] deprecation this property fallback into 1.22.x(#22928) (#22964)
• 9562c06 Backport of [UI] Remove send Action deprecation into release/1.22.x (#22957)
• 70583a7 Backport of UI/Deprecation Computed property override into release/1.22.x (#2...
• 0b00c01 Backport of UI/deprecation ember views partial into release/1.22.x (#22952)
• Additional commits viewable incompare view

Sourced fromgithub.com/hashicorp/vault/api's changelog.

Previous versions

• v1.10.0 - v1.15.16
• v1.0.0 - v1.9.10
• v0.11.6 and earlier

• 526ac82 Merge remote-tracking branch 'remotes/from/ce/main'
• 8041281 Backport Update vault-plugin-secrets-terraform to v0.13.0 into ce/main (#9814)
• dce7d8a Backport Update vault-plugin-secrets-kubernetes to v0.12.0 into ce/main (#9811)
• 9cae193 Merge remote-tracking branch 'remotes/from/ce/main'
• abde734 UI: Fix MFA validation timing issue (#9774) (#9799)
• da04c45 Merge remote-tracking branch 'remotes/from/ce/main'
• bf32d52 [UI] Ember Data Migration - KV Cleanup (#9623) (#9794)
• 0c3dcbc Backport Update vault-plugin-auth-azure to v0.22.0 into ce/main (#9782)
• 69b8abb Merge remote-tracking branch 'remotes/from/ce/main'
• 8cf2228 Fix auth method config submit following ember data migration (#9755) (#9793)
• Additional commits viewable incompare view

Sourced fromgithub.com/hashicorp/vault/api/auth/aws's changelog.

0.11.0 (August 28th, 2018)

DEPRECATIONS/CHANGES:

• Request Timeouts: A default request timeout of 90s is now enforced. Thissetting can be overwritten in the config file. If you anticipate requeststaking longer than 90s this setting should be updated before upgrading.
• (NOTE: will be re-added into 0.11.1 as it broke more than anticipated. Therewill be some further guidelines around when this will be removed again.)
  • sys/ Top Level Injection: For the last two years for backwardscompatibility data for varioussys/ routes has been injected into both theSecret's Data map and into the top level of the JSON response object.However, this has some subtle issues that pop up from time to time and isbecoming increasingly complicated to maintain, so it's finally beingremoved.
• Path Fallback for List Operations: For a very long time Vault hasautomatically adjustedlist operations to always end in a/, as listoperations operates on prefixes, so all list operations by definition endwith/. This was done server-side so affects all clients. However, thishas also led to a lot of confusion for users writing policies that assumethat the path that they use in the CLI is the path used internally. Startingin 0.11, ACL policies gain a new fallback rule for listing: they will use amatching path ending in/ if available, but if not found, they will lookfor the same path without a trailing/. This allows puttinglistcapabilities in the same path block as most other capabilities for thatpath, while not providing any extra access iflist wasn't actuallyprovided there.
• Performance Standbys On By Default: If you flavor/license of VaultEnterprise supports Performance Standbys, they are on by default. You candisable this behavior per-node with thedisable_performance_standbyconfiguration flag.
• AWS Secret Engine Roles: The AWS Secret Engine roles are now explicit aboutthe type of AWS credential they are generating; this reduces reduceambiguity that existed previously as well as enables new features forspecific credential types. Writing role data and generating credentialsremain backwards compatible; however, the data returned when reading arole's configuration has changed in backwards-incompatible ways. Anythingthat depended on reading role data from the AWS secret engine will breakuntil it is updated to work with the new format.
• Token Format (Enterprise): Tokens are now represented as a base62 value;tokens in namespaces will have the namespace identifier appended.

FEATURES:

• Namespaces (Enterprise): A set of features within Vault Enterprisethat allows Vault environments to supportSecure Multi-tenancy within asingle Vault Enterprise infrastructure. Through namespaces, Vaultadministrators can support tenant isolation for teams and individuals aswell as empower those individuals to self-manage their own tenantenvironment.

... (truncated)

• 87492f9 Cut version 0.11.0
• c05e39a Update version numbers
• dc86fde Sync plugin updates
• f913d4c UI Onboarding Wizards (#5196)
• e53560f Fix default TTL for AWS secrets (#5203)
• c9a4fdf Fix Azure Secrets API example
• 8667143 Pass the ctx value to make the race detector happy (#5201)
• 3437e82 refactor aws secret ui (#5193)
• 4377a6e Fix build
• 06b2aeb changelog++
• Additional commits viewable incompare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions