github.com/hashicorp/envconsul

Merge pull request #411 from hashicorp/prep_0.14.0

cve suppression, changelog update, version change

SECURITY:

• Upgrade github.com/hashicorp/cronexpr to v1.1.3 [GH-408]
• Update consul-temple to 0.42.1, go to 1.26.4 (#410)

Merge pull request #386 from hashicorp/sanikachavan5/update-changelog…

…-and-suppress-cves-for-0.13.4

update changelog and suppress cves

SECURITY:

• fix: critical Golang vulnerabilities (CVE-2025-22869, CVE-2025-22871) [GH-380]

IMPROVEMENTS:

• Update Golang from 1.22 to 1.25 [GH-381]

Merge pull request #367 from hashicorp/srahul3/release-v0.13.3

Updating CHANGELOG and version for the release v0.13.3

SECURITY:

• Critical Golang vulnerability in v0.13.2 [GH-366

BUG FIXES:

• Add LICENSE file to compiled linux distribution and docker image [GH-365

SECURITY:

• Update dependencies to address CVE-2022-41723.

BUG FIXES:

• Fix not passing through configuration setting properly to underlying consul-template config [GH-312, GH-310]
• Fix issue with vault agent token file reading [GH-314, GH-275]

BUG FIXES:

• Fix using an interactive shell as the command [GH-306, GH-305]
• Fix command argument parsing GH-304, GH-297]
• Version and help output to STDOUT [GH-289, GH-279]

IMPROVEMENTS:

• Support Vault K8s authorization [GH-281, GH-274]
• Allow multiple secrets with same name [GH-296]
• Don't log Go scheduler signals [GH-288, GH-285]
• Build darwin-arm64 binaries [GH-276]

BUG FIXES:

• Fix Vault lease duration default value [GH-273, GH-272].

IMPROVEMENTS:

• New docker image [GH-265, GH-258, GH-229]
• Add support for Vault Namespaces [GH-262, GH-184]
• New feature to allow only fetching a subset of keys from Vault Secret [GH-259, GH-235]
• Ability to customize environment variable names [GH-236, GH-234]
• Supports fetching service information [GH-220]

IMPROVEMENTS:

• Add support for Vault Agent token files [GH-249]
• Update whitelist/blacklist config options to allowlist/denylist with backward compatibility [GH-246]
• Update Consul Template dependency to v0.25.1 [GH-245]

BUG FIXES:

• Remove code/logic for working with (long deprecated) Vault grace [GH-245]

IMPROVEMENTS:

• Allow users to use ENV vars in prefix paths using Go templates [GH-167]

BUG FIXES:

• Fix renewing wrapped tokens, renew using unwrapped token [GH-239, GH-222]

• Fix issue with secret/prefix entries with no path [GH-240, GH-165]

DOCUMENTATION:

• Remove unused -exec-reload-signal from docs [GH-238, GH-237]

SECURITY:

• Don't log values/secrets pulled from vault [GH-226]

BUG FIXES:

• Build Arm binaries with CGO enabled [GH-227, GH-228]

SECURITY:

• curl and musl vulnerabilities in latest alpine docker image [GH-223]

IMPROVEMENTS:

• Migrated to use Go modules [GH-216, GH-217]

BREAKING CHANGES:

• When passing unevaluated, 'single quoted text' to -exec or as the command the shell variable interpolation and backtick evaluation will no longer be done. This was an undocumented 'feature' and was responsible for GH-180.

IMPROVEMENTS:

• Added support for Vault KV v2 [GH-186 GH-211]
• Respect no_prefix for consul keys [GH-190]
• Respect exec.env config block [GH-155]

BUG FIXES:

• Fix issue with shell interpolation [GH-180]
• Fix issue with PID file not being created [GH-194]
• Fix issue with Vault renew [GH-196]
• Don't panic if secret value isn't a string [GH-166]

SECURITY:

• Fixed an issue where the parent's environment could get supplied to the child process if envconsul is given an empty prefix, even when using -pristine [GH-159]

IMPROVEMENTS:

• Compile using Go 1.9.2 [GH-158]

BUG FIXES:

• Fixed Makefile to use Go version from the environment [GH-157]

IMPROVEMENTS:

• Compile using Go 1.9.0

BUG FIXES:

• Remove dynamic linking due to a missing underscore in CGO_ENABLED during compilation [GH-147]

BREAKING CHANGES:

• kill_signal (configuration) and -kill-signal (CLI) now refer to the signal that Envconsul should listen to for termination, not the signal that Envconsul should send to the child process. Use exec.kill_signal or -exec-kill-signal to specify the command to send to the child process.

DEPRECATIONS:

• (configuration) consul is now consul { address = "..." }.

• (configuration) auth is now consul { auth { ... } }.

• (configuration) path is deprecated and there is no configuration file replacement. Use the CLI option instead.

• (configuration) splay = "..." is now exec { splay = "..." }.

• (configuration) retry = "..." is now separately controlled via both the consul and vault stanzas to allow for additional configuration.

• (configuration) ssl {} is now separately controlled via both the consul and vault stanzas to allow for additional configuration.

• (configuration) timeout = "..." is now exec { kill_timeout = "..." }.

• (configuration) token = "..." is now consul { token = "..." }.

• (cli) -auth is now -consul-auth.

• (cli) -addr is now -consul-addr.

• (cli) -splay is now -exec-splay.

• (cli) -retry is now -consul-retry-* and -vault-retry-*.

• (cli) -ssl-* is now -consul-ssl-* and -vault-ssl-*.

• (cli) -timeout is now -exec-kill-timeout.

• (cli) -token is now -consul-token.

BREAKING CHANGES:

• Remove deprecated way of specifying prefixes as an array in configuration.

IMPROVEMENTS:

• Allow stripping parts of a secret path [GH-84, GH-113]

BUG FIXES:

• Overwriting existing environment variables [GH-122]
• Update Consul API library to stop logging secret data [GH-120]
• Ensure returned value is not nil [GH-124]

IMPROVEMENTS:

• Accept Key option in SSL config
• Accept stdin - this allows the user to pipe and use interactively [GH-80, GH-75]

BUG FIXES:

• Use gatedio in tests to avoid races
• Document pristine flag
• Load VAULT_TOKEN from the environment into the config [GH-99, GH-100]
• Add timeout CLI flag parsing [GH-73]
• Do not overwrite previous process when no data is returned [GH-85, GH-107]

FEATURES:

• Add a configurable kill switch [GH-48]
• Add pristine option to completely replace the environment for the command [GH-58]
• Add support for Vault configuration and prefixes
• Add support for custom key formatting
• Add splay option for sleeping a random amount of time before re-spawing the child process [GH-53]

IMPROVEMENTS:

• Improve documentation around command line vs configuration file parameters [GH-41]
• Update to new Consul Template APIs which are more efficient
• Match Makefile and semantics for other HashiCorp projects
• Set a default max-stale value of 1s
• Support reloading configuration on SIGHUP (but the signal will also be sent to the child process!)

BUG FIXES:

• Fix config merging [GH-49]
• Trim leading and trailing slashes from prefixes [GH-59]
• Fix ignored -ssl flag [GH-51]
• Remove noisy debug line [GH-55]
• Properly handle the case where a command is missing [GH-61]

DEPRECATIONS:

• Specifying the prefix before the command is deprecated, please use the -prefix key instead

FEATURES:

• Add support for logging to syslog
• Add log_level as a configuration file option and CLI option
• Add support for basic HTTP authentication when connecting to Consul
• Add support for connecting to Consul via SSL
• Add support for specifying a custom retry interval when Consul is not available
• Add support for specifying multiple prefixes using the new -prefix command line and configuration option (GH-27)
• Add support for propagating select signals to the child process (GH-31)

IMPROVEMENTS:

• Improve test coverage, specifically around command-line flag parsing
• Use Consul Template's logging library for consistency (and get syslog logging for free)

BUG FIXES:

• Fix a bug in the documentation where the environment would be reset
• Raise an error when specifying a non-existent option in the configuration file

IMPROVEMENTS:

• Allow envconsul to run when Consul is unavailable (GH-28)
• Add -max-stale to specify envconsul may talk to non-leader Consul nodes if they are less than the maximum stale value (GH-36)

BUG FIXES:

• Remove deprecated CLI and config options

FEATURES:

• Watch and reload by default - previously you needed to specify the -reload flag for envconsul to poll, but this is now the default behavior - you can restore the old behavior using the new -once flag
• Leverage watching libraries from Consul Template
• Unified command interface with Consul Template
• Added support for quiescene using the new -wait option
• Added support for Consul ACLs using the new -token option
• Added support for reading configuration from file using the new -config option - the config file is HCL

IMPROVEMENTS:

• Added -timeout parameter for specifying the interval to wait for SIGTERM to return before sending SIGKILL
• Added -version flag to print the current version of envconsul
• Added a full debug log tracer which can be set using ENV_CONSUL_LOG=debug
• Drastically improved documentation with usage examples and feature documentation
• Add significantly more test coverage (still not 100%, but more more thoroughly tested)

DEPRECATIONS:

• -addr is deprecated in favor of -consul and will be removed in the next major release
• -dc is deprecated in favor of using the inline @dc syntax and will be removed in the next major release
• -errExit, -terminate, and -reload are all deprecated in favor of -once. envconsul now intelligently exits where appropriate

FEATURES:

• Sanitize and upcase by default
• If -reload is not set, don't watch keys
• Preserve the original process environment

BUG FIXES:

• Fixed issue with prefix listing missing final forward slash
• Fixed panic condition on error

• Initial release