CHANGES packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504] IMPROVEMENTS core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555] core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506] BUG FIXE…
Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com
FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…
See also: https://openbao.org/docs/concepts/policies/#templated-policies See also: #3401 (comment) Signed-off-by: Alexander Scheel alex.scheel@control-plane.io
FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…
Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com
Signed-off-by: Enrico Fusi enrico.fusi@sap.com Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com Co-authored-by: Jonas Köhnen jonas.koehnen@sap.com
Signed-off-by: Enrico Fusi enrico.fusi@sap.com Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com Co-authored-by: Jonas Köhnen jonas.koehnen@sap.com
Signed-off-by: Enrico Fusi enrico.fusi@sap.com Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com Co-authored-by: Jonas Köhnen jonas.koehnen@sap.com
Signed-off-by: Enrico Fusi enrico.fusi@sap.com Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com Co-authored-by: Jonas Köhnen jonas.koehnen@sap.com
Signed-off-by: Enrico Fusi enrico.fusi@sap.com Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com Co-authored-by: Jonas Köhnen jonas.koehnen@sap.com
Signed-off-by: Enrico Fusi enrico.fusi@sap.com Signed-off-by: Jonas Köhnen jonas.koehnen@sap.com Co-authored-by: Jonas Köhnen jonas.koehnen@sap.com
SECURITY auth/ldap: Prevent unlikely post-bind LDAP injection via bind DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306] secrets/ldap: Prevent potential LDAP injection with unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9. [GH-3306] secrets/transit: Prevent server crash due to unlock of unlocked mutex for RSA keys created with derived=true. GHSA-8w8f-r2xv-4q4j. [GH-3309] core/leases:…
SECURITY core/auth: Fix audit logs dropping custom headers when using inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076] core: Prevent hidden default token issuance from auth plugin endpoints returning both a logical.Auth{} response object and an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150] core: Remove legacy lease endpoints (sys/revoke, sys/renew, sys/revoke-prefix, and sys/r…