diff --git a/CHANGELOG.md b/CHANGELOG.md index ac88f5af1013..ecd28d5dc53b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,36 @@ - [v1.0.0 - v1.9.10](CHANGELOG-pre-v1.10.md) - [v0.11.6 and earlier](CHANGELOG-v0.md) +## 1.17.1 +### June 26, 2024 + +CHANGES: + +* auth/jwt: Update plugin to v0.21.0 [[GH-27498](https://github.com/hashicorp/vault/pull/27498)] + +IMPROVEMENTS: + +* storage/raft: Improve autopilot logging on startup to show config values clearly and avoid spurious logs [[GH-27464](https://github.com/hashicorp/vault/pull/27464)] +* ui/secrets-sync: Hide Secrets Sync from the sidebar nav if user does not have access to the feature. [[GH-27262](https://github.com/hashicorp/vault/pull/27262)] + +BUG FIXES: + +* agent: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)] +* config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior +setting of 'deny_unauthorized' [[GH-27459](https://github.com/hashicorp/vault/pull/27459)] +* core/audit: Audit logging a Vault request/response checks if the existing context +is cancelled and will now use a new context with a 5 second timeout. +If the existing context is cancelled a new context, will be used. [[GH-27531](https://github.com/hashicorp/vault/pull/27531)] +* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)] +* proxy: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)] +* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries +* secrets-sync (enterprise): Properly remove tags from secrets in AWS when they are removed from the source association +* secrets-sync (enterprise): Return more accurate error code for invalid connection details +* secrets-sync (enterprise): Skip invalid GitHub repository names when creating destinations +* storage/azure: Fix invalid account name initialization bug [[GH-27563](https://github.com/hashicorp/vault/pull/27563)] +* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)] +* ui: Allow creation of session_token type roles for AWS secret backend [[GH-27424](https://github.com/hashicorp/vault/pull/27424)] + ## 1.17.0 ### June 12, 2024 @@ -197,6 +227,27 @@ autopilot to fail to discover new server versions and so not trigger an upgrade. * ui: fixed a bug where the replication pages did not update display when navigating between DR and performance [[GH-26325](https://github.com/hashicorp/vault/pull/26325)] * ui: fixes undefined start time in filename for downloaded client count attribution csv [[GH-26485](https://github.com/hashicorp/vault/pull/26485)] +## 1.16.5 Enterprise +### June 26, 2024 + +**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release. + +BUG FIXES: + +* cli/debug: Fix resource leak in CLI debug command. [[GH-26167](https://github.com/hashicorp/vault/pull/26167)] +* config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior +setting of 'deny_unauthorized' [[GH-27459](https://github.com/hashicorp/vault/pull/27459)] +* core/audit: Audit logging a Vault request/response checks if the existing context +is cancelled and will now use a new context with a 5 second timeout. +If the existing context is cancelled a new context, will be used. [[GH-27531](https://github.com/hashicorp/vault/pull/27531)] +* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)] +* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries +* secrets-sync (enterprise): Properly remove tags from secrets in AWS when they are removed from the source association +* secrets-sync (enterprise): Return more accurate error code for invalid connection details +* secrets-sync (enterprise): Skip invalid GitHub repository names when creating destinations +* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)] +* ui: Allow creation of session_token type roles for AWS secret backend [[GH-27424](https://github.com/hashicorp/vault/pull/27424)] + ## 1.16.4 Enterprise ### June 12, 2024 @@ -677,6 +728,16 @@ leading to failure to complete merkle sync without a full re-index. [[GH-23013]( * ui: remove user_lockout_config settings for unsupported methods [[GH-25867](https://github.com/hashicorp/vault/pull/25867)] * ui: show error from API when seal fails [[GH-23921](https://github.com/hashicorp/vault/pull/23921)] +## 1.15.11 Enterprise +### June 26, 2024 + +BUG FIXES: + +* cli/debug: Fix resource leak in CLI debug command. [[GH-26167](https://github.com/hashicorp/vault/pull/26167)] +* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)] +* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries +* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)] + ## 1.15.10 Enterprise ### June 12, 2024 diff --git a/website/content/partials/known-issues/1_16-jwt_auth_bound_audiences.mdx b/website/content/partials/known-issues/1_16-jwt_auth_bound_audiences.mdx index 78fda89c074e..afc5506f7100 100644 --- a/website/content/partials/known-issues/1_16-jwt_auth_bound_audiences.mdx +++ b/website/content/partials/known-issues/1_16-jwt_auth_bound_audiences.mdx @@ -4,13 +4,15 @@ - 1.15.9 - 1.15.10 +- 1.15.11 - 1.16.3 - 1.16.4 +- 1.16.5 #### Issue A behavior change was made in the jwt auth plugin to address CVE-2024-5798. Since the behavior change was a breaking change, we reverted the change in -the versions 1.15.11 and 1.16.5 and later. However, the behavior change will go +the versions 1.15.12 and 1.16.6 and later. However, the behavior change will go into effect in 1.17. The new behavior requires that the `bound_audiences` parameter of "jwt" roles