SECURITY: auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling. core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule. core: Use constant-time recovery token comparison secrets/spiffe (enterprise): Ensure template values are properly escaped. transform (enterprise): Add appropriate db s…
BREAKING CHANGES: containers: Remove cap_ipc_lock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory. Operators should set disable_mlock = true in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety. secrets/ssh: RSA key sizes are now limited t…
BREAKING CHANGES: containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add IPC_LOCK capabilities when running the vault container. SECURITY: api: Update golang.org/x/net to resolve GO-2026-4918" core/identity: reject wildcards in rendered identity templates core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.…
BREAKING CHANGES: sdk/helpers/docker: Migrate docker helpers from github.com/docker/docker to github.com/moby/moby. This was necessary as github.com/docker/docker is no longer maintained. Resolves GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9. SECURITY: Upgrade cloudflare/circl to v1.6.3 to resolve CVE-2026-1229 Upgrade filippo.io/edwards25519 to v1.1.1 to resolve GO-2026-4503 api/auth/gcp: Update g…
Backport [VAULT-43813] go: resolve CVE-2026-34986 and GHSA-78h2-9frx-…
This is an automated pull request to build all artifacts for a release ( #31878)
Merge remote-tracking branch 'remotes/from/ce/main'
Merge remote-tracking branch 'remotes/from/ce/main'
Merge remote-tracking branch 'remotes/from/ce/main'
Merge remote-tracking branch 'remotes/from/ce/main'