deps(go): Bump the hashicorp group across 1 directory with 4 updates

[dependabot]

Bumps the hashicorp group with 4 updates in the / directory: github.com/hashicorp/consul/api, github.com/hashicorp/vault/api, github.com/hashicorp/vault/api/auth/approle and github.com/hashicorp/vault/api/auth/userpass.

Updates github.com/hashicorp/consul/api from 1.32.1 to 1.32.4

Commits

• d869c1d Backport of api: added helper types for census reporting ent api into release...
• 0819206 Updated the changelogs and version for v1.21.5 (#22831)
• bef5f12 Backport of ui: add copyright headers to new files into release/1.21.x (#22827)
• d3e6767 Backport of bug - fix menu dropdown not opening after delete into release/1.2...
• cc346fe Backport of Fix bug consul namespaces disappearing into release/1.21.x (#22819)
• c400907 Backport of UI accessibility bugs into release/1.21.x (#22814)
• 55e3dbf Backport: sec: perform constant time compare for sensitive values (#22537) (#...
• d6001f2 Backport of [SECVULN-8636] Filter ACL for anonymous token along with empty to...
• 38febd6 Consul ENT default version change (#22783)
• 15aa895 Backport: deps: migrate mapstructure to go-viper (#22581) (#22780)
• Additional commits viewable in compare view

Updates github.com/hashicorp/vault/api from 1.20.0 to 1.22.0

Release notes

Sourced from github.com/hashicorp/vault/api's releases.

v1.20.4

No release notes provided.

v1.20.3

No release notes provided.

v1.20.2

August 06, 2025

SECURITY:

• auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [GH-31427,HCSEC-2025-20].

BUG FIXES:

• agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [GH-31392]
• identity/mfa: revert cache entry change from #31217 and document cache entry values [GH-31421]

v1.20.1

No release notes provided.

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

Previous versions

• v1.10.0 - v1.15.16
• v1.0.0 - v1.9.10
• v0.11.6 and earlier

1.20.4

September 24, 2025

SECURITY:

• core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27. (ce4b4264)

CHANGES:

• database/snowflake: Update plugin to v0.14.2 (9f06df77)

IMPROVEMENTS:

• Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions. (1fd38796)
• auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in x_forwarded_for_client_cert_header, to fix TLS certificate auth errors with Google Cloud Application Load Balancer. [GH-31501]
• secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot. (24cd1aa5)
• secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only). (0087af9d)

BUG FIXES:

• auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load. [GH-31438]
• core: Role based quotas now work for cert auth (fc775dea)
• sys/mounts: enable unsetting allowed_response_headers [GH-31555]
• ui: Fix page loading error when users navigate away from identity entities and groups list views. (81170963)

1.20.3

August 28, 2025

FEATURES:

• IBM RACF Static Role Password Phrase Management (Enterprise): Add support for static role password phrase management to the LDAP secrets engine. (hashicorp/vault-plugin-secrets-openldap#184)

SECURITY:

• core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3. (8b3a9ce1)

CHANGES:

• core: Bump Go version to 1.24.6. (ce56e14e)
• http: Add JSON configurable limits to HTTP handling for JSON payloads: max_json_depth, max_json_string_value_length, max_json_object_entry_count, max_json_array_element_count. [GH-31069]
• sdk: Upgrade to go-secure-stdlib/[email protected], which also bumps github.com/docker/docker to v28.3.3+incompatible (8f172169)
• secrets/openldap (enterprise): update plugin to v0.16.1

IMPROVEMENTS:

... (truncated)

Commits

• 526ac82 Merge remote-tracking branch 'remotes/from/ce/main'
• 8041281 Backport Update vault-plugin-secrets-terraform to v0.13.0 into ce/main (#9814)
• dce7d8a Backport Update vault-plugin-secrets-kubernetes to v0.12.0 into ce/main (#9811)
• 9cae193 Merge remote-tracking branch 'remotes/from/ce/main'
• abde734 UI: Fix MFA validation timing issue (#9774) (#9799)
• da04c45 Merge remote-tracking branch 'remotes/from/ce/main'
• bf32d52 [UI] Ember Data Migration - KV Cleanup (#9623) (#9794)
• 0c3dcbc Backport Update vault-plugin-auth-azure to v0.22.0 into ce/main (#9782)
• 69b8abb Merge remote-tracking branch 'remotes/from/ce/main'
• 8cf2228 Fix auth method config submit following ember data migration (#9755) (#9793)
• Additional commits viewable in compare view

Updates github.com/hashicorp/vault/api/auth/approle from 0.10.0 to 0.11.0

Changelog

Sourced from github.com/hashicorp/vault/api/auth/approle's changelog.

0.11.0 (August 28th, 2018)

DEPRECATIONS/CHANGES:

• Request Timeouts: A default request timeout of 90s is now enforced. This setting can be overwritten in the config file. If you anticipate requests taking longer than 90s this setting should be updated before upgrading.
• (NOTE: will be re-added into 0.11.1 as it broke more than anticipated. There will be some further guidelines around when this will be removed again.)
  • sys/ Top Level Injection: For the last two years for backwards compatibility data for various sys/ routes has been injected into both the Secret's Data map and into the top level of the JSON response object. However, this has some subtle issues that pop up from time to time and is becoming increasingly complicated to maintain, so it's finally being removed.
• Path Fallback for List Operations: For a very long time Vault has automatically adjusted list operations to always end in a /, as list operations operates on prefixes, so all list operations by definition end with /. This was done server-side so affects all clients. However, this has also led to a lot of confusion for users writing policies that assume that the path that they use in the CLI is the path used internally. Starting in 0.11, ACL policies gain a new fallback rule for listing: they will use a matching path ending in / if available, but if not found, they will look for the same path without a trailing /. This allows putting list capabilities in the same path block as most other capabilities for that path, while not providing any extra access if list wasn't actually provided there.
• Performance Standbys On By Default: If you flavor/license of Vault Enterprise supports Performance Standbys, they are on by default. You can disable this behavior per-node with the disable_performance_standby configuration flag.
• AWS Secret Engine Roles: The AWS Secret Engine roles are now explicit about the type of AWS credential they are generating; this reduces reduce ambiguity that existed previously as well as enables new features for specific credential types. Writing role data and generating credentials remain backwards compatible; however, the data returned when reading a role's configuration has changed in backwards-incompatible ways. Anything that depended on reading role data from the AWS secret engine will break until it is updated to work with the new format.
• Token Format (Enterprise): Tokens are now represented as a base62 value; tokens in namespaces will have the namespace identifier appended.

FEATURES:

• Namespaces (Enterprise): A set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy within a single Vault Enterprise infrastructure. Through namespaces, Vault administrators can support tenant isolation for teams and individuals as well as empower those individuals to self-manage their own tenant environment.

... (truncated)

Commits

• 87492f9 Cut version 0.11.0
• c05e39a Update version numbers
• dc86fde Sync plugin updates
• f913d4c UI Onboarding Wizards (#5196)
• e53560f Fix default TTL for AWS secrets (#5203)
• c9a4fdf Fix Azure Secrets API example
• 8667143 Pass the ctx value to make the race detector happy (#5201)
• 3437e82 refactor aws secret ui (#5193)
• 4377a6e Fix build
• 06b2aeb changelog++
• Additional commits viewable in compare view

Updates github.com/hashicorp/vault/api/auth/userpass from 0.10.0 to 0.11.0

Changelog

Sourced from github.com/hashicorp/vault/api/auth/userpass's changelog.

0.11.0 (August 28th, 2018)

DEPRECATIONS/CHANGES:

• Request Timeouts: A default request timeout of 90s is now enforced. This setting can be overwritten in the config file. If you anticipate requests taking longer than 90s this setting should be updated before upgrading.
• (NOTE: will be re-added into 0.11.1 as it broke more than anticipated. There will be some further guidelines around when this will be removed again.)
  • sys/ Top Level Injection: For the last two years for backwards compatibility data for various sys/ routes has been injected into both the Secret's Data map and into the top level of the JSON response object. However, this has some subtle issues that pop up from time to time and is becoming increasingly complicated to maintain, so it's finally being removed.
• Path Fallback for List Operations: For a very long time Vault has automatically adjusted list operations to always end in a /, as list operations operates on prefixes, so all list operations by definition end with /. This was done server-side so affects all clients. However, this has also led to a lot of confusion for users writing policies that assume that the path that they use in the CLI is the path used internally. Starting in 0.11, ACL policies gain a new fallback rule for listing: they will use a matching path ending in / if available, but if not found, they will look for the same path without a trailing /. This allows putting list capabilities in the same path block as most other capabilities for that path, while not providing any extra access if list wasn't actually provided there.
• Performance Standbys On By Default: If you flavor/license of Vault Enterprise supports Performance Standbys, they are on by default. You can disable this behavior per-node with the disable_performance_standby configuration flag.
• AWS Secret Engine Roles: The AWS Secret Engine roles are now explicit about the type of AWS credential they are generating; this reduces reduce ambiguity that existed previously as well as enables new features for specific credential types. Writing role data and generating credentials remain backwards compatible; however, the data returned when reading a role's configuration has changed in backwards-incompatible ways. Anything that depended on reading role data from the AWS secret engine will break until it is updated to work with the new format.
• Token Format (Enterprise): Tokens are now represented as a base62 value; tokens in namespaces will have the namespace identifier appended.

FEATURES:

• Namespaces (Enterprise): A set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy within a single Vault Enterprise infrastructure. Through namespaces, Vault administrators can support tenant isolation for teams and individuals as well as empower those individuals to self-manage their own tenant environment.

... (truncated)

Commits

• 87492f9 Cut version 0.11.0
• c05e39a Update version numbers
• dc86fde Sync plugin updates
• f913d4c UI Onboarding Wizards (#5196)
• e53560f Fix default TTL for AWS secrets (#5203)
• c9a4fdf Fix Azure Secrets API example
• 8667143 Pass the ctx value to make the race detector happy (#5201)
• 3437e82 refactor aws secret ui (#5193)
• 4377a6e Fix build
• 06b2aeb changelog++
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions