2.1.0 (October 21, 2026) BREAKING CHANGES: agent: (Enterprise only) Agent HTTP API request bodies are now limited to 512 KiB by default, including chunked requests and requests with an unsupported method, and oversized requests return HTTP 413 before the body is read in full. Very large /v1/config writes that previously succeeded can now fail. Raise the limit with the new limits.http_max_request_b…
Release troubleshoot v0.10.1
Release envoyextensions v0.11.1
update sdk, envoyextensions and api to ga version
update sdk and api to ga version
update sdk to ga version
update sdk to ga version
Backport of security: remove root hashicorp/consul dependency from te…
2.1.0-rc2 (October 12, 2026) SECURITY: Upgrade go version to 1.26.9 to address security vulnerabilities. [GH-24010] deps: Upgrade github.com/hashicorp/raft-wal to v0.5.0 (with raft v1.8.0, serf v0.11.0, memberlist v0.7.0 and go-metrics v0.7.0), removing the dependency on github.com/coreos/etcd. [GH-23985] deps: Upgrade golang.org/x/net to v0.60.0 to address GO-2026-6610, GO-2026-6611, GO-2026-6603…
2.1.0-rc1 (September 28, 2026) BREAKING CHANGES: cli: Migrated the consul connect redirect-traffic command from iptables/ip6tables to nftables (nft). The command now uses the sdk/nftables package, which applies all IPv4 and IPv6 rules atomically in a single pass via the nftables inet address family, instead of separate iptables and ip6tables invocations. [GH-23785] cli: Transparent proxy exclusion…
update api,sdk,envoyextensions in troubleshoot
update api and sdk in envoyextensions
update sdk version in api
structs: backport inference gateway types to CE Adds the inference-gateway service kind, config entry kind, and their API, structs, agent-config, and proto surface so consumers such as consul-k8s can build against them. The inference gateway is an enterprise feature: CE rejects the config entry in Validate and the service kind in NodeService.Validate. Mirrors the CAMP structs backport (#23842). Th…
chore(troubleshoot): comment out local replace directives and bump in…
chore(envoyextensions): comment out local replace directives and bump…
sub module release
Dummy changelog tag for Enterprise-only patch release 1.22.12
Dummy changelog tag for Enterprise-only patch release 2.0.4
Dummy changelog tag for Enterprise-only patch release 1.21.18
2.0.4 (September 10, 2026) BREAKING CHANGES: acl: Tokens that hold service:write but not mesh:write will now receive a permission-denied error when attempting to attach builtin/lua or builtin/wasm EnvoyExtensions (or upstream envoy_listener_json/envoy_cluster_json escape-hatch overrides) to a service-defaults config entry, or when registering a connect-proxy sidecar with bootstrap or xDS escape-ha…
fix: upgrade golang.org/x/mod and golang.org/x/crypto to address CVEs…
fix: upgrade golang.org/x/mod and golang.org/x/crypto to address CVEs…
2.0.2 (July 8, 2026) SECURITY: Upgrade alpine base image version to 3.24 to address [CVE-2026-41989], [ALPINE-CVE-2026-2100]. [GH-23711] dependency: Upgrade Serf and Memberlist to use the latest versions. [GH-23704] xds: Return errors when injecting the L4 intention (RBAC) filter or the mTLS transport socket onto an inbound public listener, so the listener is not served without intention enforceme…
chore: comment out local sdk replace directive in go.mod
chore: comment out local sdk replace directive in go.mod
chore: comment out local sdk replace directive in go.mod
chore: comment out local sdk replace directive in go.mod
2.0.3 (August 7, 2026) SECURITY: Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786] Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786] Update golang.org/x/text to v0.39.0 to address GO-2026-5970. [GH-23761] Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf. [GH-2…
sub module release go mod update for troubleshoot