hashicorp/consul-k8s v1.9.12

on GitHub

1.9.12 (September 10, 2026)

SECURITY:

• Upgrade go version to 1.26.7 to address security vulnerabilities. [GH-5627]
• dockerfile: Remove unnecessary root group membership for the user in ubi-based consul-k8s-control-plane image. [GH-5640]
• security: upgrade golang.org/x/crypto to v0.57.0, golang.org/x/net to v0.59.0, and google.golang.org/grpc to v1.83.2 across the control-plane, CLI, acceptance, CNI, and custom gateway-api modules to resolve security vulnerabilities. [GH-5648]

IMPROVEMENTS:

• Helm: Expose connectInject.cni.tolerations as a configurable Helm value to allow operators to override CNI DaemonSet tolerations. Defaults to tolerating CriticalAddonsOnly and NoExecute taints when not set. [GH-5562]
• security: build FIPS artifacts against the in-tree Go Cryptographic Module (FIPS 140-3, GOFIPS140=v1.0.0, CMVP Certificate #5247) instead of BoringCrypto/CNG. FIPS binaries now run in FIPS mode via a baked-in //go:debug fips140=on, are pure Go (no cgo), and the artifact/version label changes from fips1402 to fips1403. [GH-5492]