Vault 1.19.0, 1.18.6, 1.17.13, 1.16.17 released!

Release Notifications
1

Hi all,

The Vault team is announcing the release of Vault Community Edition 1.19.0 and Vault Enterprise 1.19.0, 1.18.6, 1.17.13, and 1.16.17.

The 1.19.0 Community Edition binary can be downloaded at [1]. Enterprise binaries are available to customers as well.

As a reminder, if you believe you have found a security issue in Vault, please responsibly disclose by emailing security@hashicorp.com and do not use the public issue tracker. Our security policy and our PGP key can be found at [2].

The major features and improvements in these releases are:

  • Vault PKI Support for Constrained CAs (Enterprise): Customers can set up constrained intermediate CAs to limit certificate issuance to specific workloads to improve security. This feature will also enable secure delegation of PKI administration.
  • Vault Supports PQC algorithms (ml-dsa) (Enterprise): Vault Transit engine support for ml-dsa (sig/verify) PQC algorithm enables customers to experiment with, and validate their systems for post-quantum readiness.
  • Resolution of Identity duplicates: Bugs in older versions of Vault have caused some users’ clusters to have duplicate entries in the Identity engine, which can trigger unexpected behavior. There is now a flag that can be set for a one-time cleanup of all duplicate Identity artifacts in the cluster. To determine if your cluster has duplicates and for further instructions, please follow this guide[10]. We have also made Vault’s loading of entities faster and more deterministic to prevent duplicates in the future.
  • External Enterprise Plugins: Vault Enterprise secrets engines and authentication plugins are able to be run external to the Vault binary, for deployments that require plugin-specific control of outbound network traffic via HTTP_PROXY environment variables.
  • Client Counting Bug Fixes: We addressed some issues that were causing errors or discrepancies when counting client activity on authentication methods or in namespaces that were deleted when the activity was counted. We also normalized start and end times for client counting queries across our APIs to ensure consistency.

Please note that these releases also address an issue with unseal and Azure.

See the Changelog at [3] for the full list of improvements and bug fixes.

See the Feature Deprecation Notice and Plans page [8] for our upcoming feature deprecation plans.

Community [6] and Enterprise [7] Docker images will be available soon.

Upgrading

See [4] for general upgrade instructions and [5] for upgrade instructions and known issues.

As always, we recommend upgrading and testing this release in an isolated environment. If you experience any non-security issues, please report them on the Vault GitHub issue tracker or post to the Vault Discuss Forum at [9].

We hope you enjoy Vault 1.19.0!

Sincerely, The Vault Team

[1] Vault v1.19.0 Binaries | HashiCorp Releases

[2] Security at HashiCorp

[3] vault/CHANGELOG.md at main · hashicorp/vault · GitHub

[4] Upgrading Vault - Guides | Vault | HashiCorp Developer

[5] Release Notes | Vault | HashiCorp Developer

[6] https://hub.docker.com/r/hashicorp/vault

[7] https://hub.docker.com/r/hashicorp/vault-enterprise

[8] Deprecation notices | Vault | HashiCorp Developer

[9] Vault - HashiCorp Discuss

[10] Resolve duplicate identities | Vault | HashiCorp Developer