github.com/hashicorp/consul-esm

Merge pull request #388 from hashicorp/prep_0.11.0

suppressing "GO-2026-5932" as fix not available

SECURITY FIXES:

• Upgrade to Go 1.26.4 to pick up the latest standard library security fixes [GH-378]
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 to address gRPC server authorization bypass vulnerability [GH-366]

IMPROVEMENTS:

• Allow disabling agentless check update batching and document the batch_flush_interval config option [GH-373]
• Add gRPC health check support to ESM alongside existing HTTP and TCP checks [GH-319]
• Add Go test coverage reporting with CI integration and coverage badge [GH-377]
• Update serf and consul/api dependencies to latest versions [GH-386]
• Make fetching nodes faster when getting health checks by using regex-filtered, stale-read queries to the Consul server [GH-365]

BUG FIXES:

• Fix stale_read_nodes not being decoded or merged from config by adding missing HumanConfig and MergeConfig bindings [GH-380]

Stage 0.10.0 release (#363)

* Stage 0.10.0 release

* Restore changelog fragments for 0.10.0 prep

* Fix changelog fragment formatting

IMPROVEMENTS:

• Speed up health check discovery across namespaces by using a single wildcard-namespace query where supported, reducing detection time for new services at scale [GH-354]
• Batch agentless health check updates into Consul transactions to reduce API round-trips and improve update throughput at scale [GH-348]
• Improve ESM resiliency, logging, and internal cleanup behavior [GH-355]

BUG FIXES:

• Reduce delays when rebalancing health check monitoring to newly added ESM instances after scaling out [GH-346]
• Fix a race condition that could lead to goroutine leaks at scale [GH-349]
• Improve agentless session lock reliability [GH-352]

SECURITY FIXES:

• Upgrade Consul Go module dependencies to address CVE-2025-11374 and CVE-2025-11375 [GH-345], [GH-347]

Merge pull request #332 from hashicorp/shashank/prepare-release-0.9.1

update changelog and version for 0.9.1 release

IMPROVEMENTS: Enhance ESM telemetry to include functional activity metrics [GH-327]

Enhance service deregistration logic for agentless mode (#311)

Co-authored-by: srahul3 <[email protected]>

IMPROVEMENTS: Enhance service deregistration logic for agentless mode [GH-311]

Security issue - libs version bump (#285)

* Release PR

* Fixing security issues with go-retryhttp & grpc libs

* adding change log for this fix

* cleanup

* cleanup

* Update CHANGELOG.md

Co-authored-by: sarahalsmiller <[email protected]>

---------

Co-authored-by: srahul3 <[email protected]>
Co-authored-by: sarahalsmiller <[email protected]>

IMPROVEMENTS:

• Add support for Admin-Partitions [GH-259]

SECURITY FIXES:

• Upgrade go module go-retryablehttp to address CVE-2024-6104
• Upgrade go module grpc to address GO-2024-2978

update go modules (#264)

* update go modules

* update go version

* consul 1.18.2 has an incompatibility with logfile_bsd.go for openbsd builds, downgrading consul api version until we can fix that

BUG FIXES:

• fix updates for checks in namespaces [GH-259]

BUG FIXES:

• fix goroutine/memory leak [GH-196, GH-194]

IMPROVEMENTS:

• Enable ESM single instance to monitor all namespaces [GH-191, GH-143]
• Add support for pprof endpoints [GH-189]

BUG FIXES:

• Fix deadlock on checkrunner [GH-193, GH-192]
• Fix USER setting in docker config [GH-176]

BUG FIXES:

• Fix issue with spurious HTTP checks [GH-171, GH-158]
• Fix deadlock in check updates [GH-170, GH-159]
• Discard startup text when using JSON logging [GH-169, GH-161]
• Fix regression with log_json setting [GH-168]

IMPROVEMENTS:

• Add support for TLSServerName for HTTP health checks [GH-116]
• Add external-source Metadata when registering consul-esm as a service [GH-95]

BUG FIXES:

• Handle case of same service ID on different nodes [GH-135]
• Dependency Updates GH-134], GH-132]
  • Update go-ping dependency to fix deadlock[GH-129]
  • Fix issue with cross signed certs [GH-84]
• ESM doesn't deregister if status and output are same as before [GH-130]
• Add -v and use standard version output [GH-126, GH-125]
• External node checks disappear after re-registration of nodes [GH-128, GH-119]

IMPROVEMENTS:

• Add official docker image [GH-108, GH-19]
• Add support for Consul Namespaces and controlling which namespaces ESM monitors. [GH-115]
• Add support for arm64 builds. [GH-98, GH-88]
• Update logging to use hclog. [GH-97]
• Add log_json configuration option to allow enabling JSON logging. [GH-105, GH-82]
• Update -version output to standardize with other ecosystem projects. [GH-99, GH-87]

BUG FIXES:

• Fixed issue where anti-flapping counters were reset to zero when updating checks with latest from catalog. [GH-103]

IMPROVEMENTS:

• Add metrics support with configurable telemetry block. [GH-67]
• Add configurable http endpoint to expose telemetry metrics. [GH-90, GH-89]
• Support anti-flapping with configuration options passing_threshold and critical_threshold. [GH-78, GH-50]
• Update caught signal log from info-level to debug-level. [GH-79]
• Improve flaky tests. [GH-80]
• Add mTLS support for HTTPS checks with configuration options https_ca_file, https_ca_path, https_cert_file, and https_key_file. [GH-81, GH-72]

BUG FIXES:

• Remove checking status when syncing checks, which can cause flapping. [GH-83]
• Reduce goroutines used in external-probe ping. [GH-85]

DOCUMENTATION:

• Fix outdated "Consul ACL Policies" to include operator = "read" needed for 0.4.0 feature to check ESM and Consul version compatibility. [GH-75 & GH-91, GH-74]
• New documentation on finer-grained ACL policies and context on how each ACL is used. [GH-76, GH-77]

IMPROVEMENTS:

• Update to compile with Go version 1.13. [GH-64]
• Prevent health checks from running more frequently than once per second. [GH-63]
• Prevent spurious node status updates so that they only update on status change or status expiration. [GH-63]
• Allow disabling coordinate updates with disable_coordinate_updates configuration option. [GH-63]
• Support clusters of over 64 ESM instances. [GH-63]
• Skip updating small changes in node coordinates. [GH-63]
• Add more logging. [GH-63]
• Add consul version compatibility check on startup. [GH-62]
• Switch to Go Modules. [GH-47]
• Allow setting a unique ESM instance id with instance_id configuration option. [GH-61, GH-60]

BUG FIXES:

• Fix an issue when there are no healthy Consul instances. [GH-48, GH-43]
• Fix broken ping by switching to new library. [GH-46, GH-45]
• Fix spurious updates that cause delays in updating health checks by reading health check in consistent mode. [GH-68]

DOCUMENTATION:

• Request users to use :+1: voting system to help prioritize issues and pull requests. [GH-57]
• Clarification on time when ESM becomes critical and deregisters. [GH-54]
• Minimum ACL rules required to run ESM. [GH-66]

BUG FIXES:

• Set a default check interval of 30s. This prevents the check from running in a busy loop if consul-esm gets back an empty check interval from the api.
• Fixed an issue where the catalog would not be updated despite a change in a health probe result.[GH-36]

BUG FIXES:

• Fixed an issue where updates to external nodes or their health by the user could be overwritten by Consul-ESM. Now uses the transaction API in Consul for catalog operations.

IMPROVEMENTS:

• Pings to external nodes now run in parallel over the node_probe_interval instead of serially.

BUG FIXES:

• Fixed an issue where the wrong KV path was used for node health.

IMPROVEMENTS:

• The work of health checking and node probing will now be divided up amongst all ESM agents that share a consul_service/consul_service_tag/consul_kv_path combination. This is done by the leader using the KV store for coordination. The consul_leader_key field has been replaced by consul_kv_path, which is a path to a KV directory for a coordinating set of ESM nodes to share.
• Added the node_probe_interval config field for controlling how often ESM will attempt to probe each external node.
• Check definitions can now be updated in-place. [GH-17]

BUG FIXES:

• Fixed an issue where the coordinate loop would run constantly and burn CPU when there were no nodes to probe.

IMPROVEMENTS:

• Correctly exit on SIGTERM as well as SIGINT.
• Use a simpler UDP ping that doesn't require root privileges. [GH-5]
• Add a config option for setting the ping method (UDP or socket).

BUG FIXES:

• Fixed the DeregisterCriticalServiceAfter field not being handled correctly. [GH-7]

• Initial release