What hashicorp/vault shipped
Written by FoxPlug from the repository's own releases; not affiliated with HashiCorp. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/hashicorp/vault; HashiCorp did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- The release candidate removes the
cap_ipc_lockcapability from the Vault container image, so Vault in containers can no longer call mlock() and operators should setdisable_mlock= true. Release - The patch release tightens ACME finalization with the default sign-verbatim directory policy to reject CSRs containing URI SANs, email SANs, or Other SANs, since ACME challenges only verify DNS names and IP addresses. Release
- An automated pull request builds all release artifacts for the ce/release/2.2.x line. Pull request #32146
- An automated pull request builds all release artifacts for the ce/release/2.1.x line. Pull request #32144
- An automated pull request builds all release artifacts for the ce/release/2.1.x line. Pull request #32143
Why it matters
This week brings a release candidate and a patch release, each with breaking changes for container and PKI users. Container operators must now set disable_mlock = true because the image no longer grants the capability needed for mlock(). PKI operators using the default sign-verbatim directory policy must ensure ACME CSRs do not include URI, email, or Other SANs.
Changelog entry
- Containers: Remove
cap_ipc_lockcapability on vault at build time to allow running Vault in common container runtimes; Vault in containers will no longer be able to call mlock() to lock memory, and operators should setdisable_mlock= true. Release - Pki: ACME finalization with the default sign-verbatim directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs, because ACME challenges only verify DNS names and IP addresses. Release
- Release: create all artifacts for ce/release/2.2.x. Pull request #32146
- Release: create all artifacts for ce/release/2.1.x. Pull request #32144
- Release: create all artifacts for ce/release/2.1.x. Pull request #32143
V2.2.0-rc1: container image no longer has cap_ipc_lock, so mlock() is unavailable; set disable_mlock = true. v2.1.2: ACME finalization with the default sign-verbatim policy now rejects CSRs with URI, email, or Other SANs.
Two releases this week. v2.2.0-rc1 removes the cap_ipc_lock capability from the Vault container image at build time to allow Vault to run in common container runtimes. Because the image no longer grants that capability, Vault in containers cannot call mlock() to lock memory; operators should set disable_mlock = true in Vault's configuration. v2.1.2 changes ACME behavior: finalization with the default sign-verbatim directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses, so those SAN types are never validated and must not appear in issued certificates. Release artifact builds for the 2.2.x and 2.1.x lines also ran this week.