VAULT-2.0.1 release notes and known issues

Summary

BREAKING CHANGES: containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add IPC_LOCK capabilities when running the vault container. SECURITY: api: Update golang.org/x/net to resolve GO-2026-4918" core/identity: reject wildcards in rendered identity templates core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4 core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1. core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx . core: Update golang.org/x/net to resolve GO-2026-4918" core: Validate both path and file_path cannot be empty for requests to sys/audit/{path} sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4 sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1. sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx . sdk: Update golang.org/x/net to resolve GO-2026-4918" CHANGES: auth/jwt: Update plugin to v0.26.3 core: Bump Go version to 1.26.3 identity: Require sudo capability to invoke the identity entity merge API endpoint (identity/entity/merge). secrets/azure: Update plugin to v0.26.2+ent secrets/openldap: Update plugin to v0.18.1+ent FEATURES: Billing metrics dashboard: Create a new billing dashboard with responsive layout to display metric data. Secrets Sync UI: Added Workload Identity Federation (WIF) support in the UI for AWS, Azure, and GCP sync destinations IMPROVEMENTS: api: Add start_month and end_month parameters to /sys/billing/overview endpoint to allow querying billing data for specific time ranges. api: Add migration_done_at_epoch to sys/seal-status response. consumption-billing: Add billing tracking for OS Local Account static roles to support consumption-based billing metrics and high-water mark (HWM) tracking. consumption-billing: Added consumption billing metrics for OIDC tokens. consumption-billing: Added consumption billing metrics for PKI External CA certificates. consumption-billing: Added consumption billing metrics for SPIFFE JWT tokens. consumption-billing: Enabled sys/billing/overview endpoint in admin namespace. consumption-billing: Float64 values returned by sys/billing/overview are now rounded to 4 decimal places. consumption-billing: Increased billing data retention from 2 months to 37 months. The /sys/internal/billing/overview API endpoint now returns 37 months of historical consumption billing data by default. consumption-billing: The /sys/internal/billing/overview API endpoint now always returns all metric types in the response, even when their values are zero. This ensures consistent response structure for easier client-side parsing. core (Enterprise): Sanitized config now shows kms_library config. core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability. scim: The SCIM Group PATCH handler now supports the path field in the form members[value eq "id"] on remove operations. sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config. sdk: add WIF and rotation helpers for checking if params were updated to allow the consumer to know when changes need to be persisted to storage secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key secrets/transit: Change to using Trail of Bits libraries for PQC signature implementation in Transit ui/dashboard: Reorganized dashboard widgets to improve layout and usability. Updated widgets to use HDS table components for better consistency. Enhanced the Quick Actions card with frequently used links alongside existing actions. ui: Set pagination size to

Improvements and security content

• BREAKING CHANGES: containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add IPC_LOCK capabilities when running the vault container. SECURITY: api: Update golang.org/x/net to resolve GO-2026-4918" core/identity: reject wildcards in rendered identity templates core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4 core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1. core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx . core: Update golang.org/x/net to resolve GO-2026-4918" core: Validate both path and file_path cannot be empty for requests to sys/audit/{path} sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4 sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1. sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx . sdk: Update golang.org/x/net to resolve GO-2026-4918" CHANGES: auth/jwt: Update plugin to v0.26.3 core: Bump Go version to 1.26.3 identity: Require sudo capability to invoke the identity entity merge API endpoint (identity/entity/merge). secrets/azure: Update plugin to v0.26.2+ent secrets/openldap: Update plugin to v0.18.1+ent FEATURES: Billing metrics dashboard: Create a new billing dashboard with responsive layout to display metric data. Secrets Sync UI: Added Workload Identity Federation (WIF) support in the UI for AWS, Azure, and GCP sync destinations IMPROVEMENTS: api: Add start_month and end_month parameters to /sys/billing/overview endpoint to allow querying billing data for specific time ranges. api: Add migration_done_at_epoch to sys/seal-status response. consumption-billing: Add billing tracking for OS Local Account static roles to support consumption-based billing metrics and high-water mark (HWM) tracking. consumption-billing: Added consumption billing metrics for OIDC tokens. consumption-billing: Added consumption billing metrics for PKI External CA certificates. consumption-billing: Added consumption billing metrics for SPIFFE JWT tokens. consumption-billing: Enabled sys/billing/overview endpoint in admin namespace. consumption-billing: Float64 values returned by sys/billing/overview are now rounded to 4 decimal places. consumption-billing: Increased billing data retention from 2 months to 37 months. The /sys/internal/billing/overview API endpoint now returns 37 months of historical consumption billing data by default. consumption-billing: The /sys/internal/billing/overview API endpoint now always returns all metric types in the response, even when their values are zero. This ensures consistent response structure for easier client-side parsing. core (Enterprise): Sanitized config now shows kms_library config. core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability. scim: The SCIM Group PATCH handler now supports the path field in the form members[value eq "id"] on remove operations. sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config. sdk: add WIF and rotation helpers for checking if params were updated to allow the consumer to know when changes need to be persisted to storage secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key secrets/transit: Change to using Trail of Bits libraries for PQC signature implementation in Transit ui/dashboard: Reorganized dashboard widgets to improve layout and usability. Updated widgets to use HDS table components for better consistency. Enhanced the Quick Actions card with frequently used links alongside existing actions. ui: Set pagination size to

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence