Skip to content

chore(deps): update hashicorp/vault requirement from ~> 4.0 to ~> 5.11 in /terraform - #57

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/terraform/terraform/hashicorp/vault-tw-5.11
Open

chore(deps): update hashicorp/vault requirement from ~> 4.0 to ~> 5.11 in /terraform#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/terraform/terraform/hashicorp/vault-tw-5.11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown

Updates the requirements on hashicorp/vault to permit the latest version.

Release notes

Sourced from hashicorp/vault's releases.

v5.11.0

5.11.0 (August 14, 2026)

FEATURES:

  • New Resources: Add support for GCP KMS secrets engine with vault_gcpkms_secret_backend and vault_gcpkms_secret_backend_key resources, vault_gcpkms_verify data source, and ephemeral resources vault_gcpkms_encrypt, vault_gcpkms_decrypt, vault_gcpkms_reencrypt, and vault_gcpkms_sign for cryptographic operations. Includes internal Plugin Framework mount_helpers for Vault mount operations to support incremental migration from SDKv2. (#2763)
  • New resource for transform key configurations: vault_transform_key_configuration - Supports setting an auto_rotate_period and min_decryption_version to keys used in for tokenization transformations. This uses this endpoint to modify the configuration and this one to read configurations. (#2980)
  • LDAP Role Level Password Policy Support: Added password_policy parameter to vault_ldap_secret_backend_static_role and vault_ldap_secret_backend_dynamic_role resources to support role-level password policy configuration (#2921). Requires Vault 2.2.0+.
  • LDAP Rotate-on-Read Support: Added rotate_on_read and rotate_on_read_cooldown parameters to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role resources, and rotated_on_read attribute to vault_ldap_static_role_credentials data source to support credential rotation on each read (#2960. Requires Vault Enterprise 2.2.0+.
  • LDAP Account Unlock for Static Role: Added auto_unlock field (Optional+Computed) to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role. When set at the mount level, Vault automatically unlocks the managed AD account after every successful static-role rotation, the per-role field overrides the mount-level setting, and when unset the role inherits the mount default. Active Directory schema only. Requires Vault Enterprise 2.2.0+.(#2977)
  • Terraform Secret Engine Root Rotation Support: Add support for automated root token rotation via the rotation_period, rotation_schedule, rotation_window, and disable_automated_rotation fields, and add explicit_max_ttl to bound the lifetime of the rotated root token. Requires Vault 2.2.0+. (#2958)
  • Add support for Kerberos auth backend: vault_kerberos_auth_backend_config, vault_kerberos_auth_backend_ldap_config, and vault_kerberos_auth_backend_group resources, and vault_kerberos_auth_backend_login ephemeral resource for Kerberos authentication. (#2819)
  • Secrets Sync customer controlled encryption: vault_secrets_sync_aws_destination and vault_secrets_sync_gcp_destination now support Vault 2.2.0+ fields kms_key_id and replica_regions; and deprecated GCP legacy fields global_kms_key, locational_kms_keys, and replication_locations in favor of kms_key_id and replica_regions. (#2965)
  • Add support for pkcs12_bundle and jks_bundle formats (without setting default values) in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2946). Requires Vault 2.0.5+.

IMPROVEMENTS:

  • Migrated AWS provider dependency from aws-sdk-go (v1) to aws-sdk-go-v2 for improved performance and maintainability. (#2882)
  • vault_identity_entity_alias: Add support for external_id and issuer fields. Available only for Vault Enterprise. (#2994)
  • vault_aws_auth_backend_config_identity: Add support for canonical_arn as a valid value for the iam_alias parameter. Requires Vault 1.16+. (#2982)
  • vault_jwt_auth_backend: Add string-to-integer conversion for groups_cap field in provider_config to support Okta provider configuration. (#2939)
  • Autosnapshot support for AWS IRSA: Added documentation for IRSA usage per changes in Vault (hashicorp/raft-snapshotagent#49). IRSA feature requires Vault 2.2.0+
  • Updated dependencies:
    • Bumped 13 Go module dependencies (#2969)
    • Bumped 10 Go module dependencies (#2990)
    • actions/checkout v7.0.0 → v7.0.1
    • actions/setup-go v6.4.0 → v7.0.0
    • actions/cache v5.0.5 → v6.1.0
    • golang.org/x/mod v0.37.0 → v0.40.0 (fixes GO-2026-6179, GO-2026-6180)
    • golang.org/x/crypto v0.54.0 → v0.55.0
    • golang.org/x/net v0.57.0 → v0.58.0
    • golang.org/x/text v0.40.0 → v0.41.0
    • golang.org/x/tools v0.47.0 → v0.49.0
    • cloud.google.com/go/iam v1.12.0 → v1.13.0
    • cloud.google.com/go/auth v0.20.0 → v0.23.0
    • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 → v1.23.0
    • github.com/aws/aws-sdk-go-v2 v1.43.0 → v1.43.5
    • github.com/aws/aws-sdk-go-v2/config v1.32.31 → v1.32.36
    • github.com/aws/aws-sdk-go-v2/credentials v1.19.30 → v1.19.35
    • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 → v1.18.36
    • github.com/aws/aws-sdk-go-v2/service/iam v1.56.0 → v1.59.0
    • github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 → v1.45.5
    • github.com/aws/smithy-go v1.27.3 → v1.27.7
    • github.com/hashicorp/terraform-plugin-log v0.10.0 → v0.11.0
    • github.com/moby/moby/client v0.5.0 → v0.5.1
    • google.golang.org/api v0.287.1 → v0.293.0
    • google.golang.org/genproto v0.0.0-20260622175928 → v0.0.0-20260810153831
    • google.golang.org/grpc v1.82.1 → v1.83.0
    • k8s.io/utils v0.0.0-20260617174310 → v0.0.0-20260707023825
  • Build and CI changes:

... (truncated)

Changelog

Sourced from hashicorp/vault's changelog.

5.11.0 (August 14, 2026)

FEATURES:

  • New Resources: Add support for GCP KMS secrets engine with vault_gcpkms_secret_backend and vault_gcpkms_secret_backend_key resources, vault_gcpkms_verify data source, and ephemeral resources vault_gcpkms_encrypt, vault_gcpkms_decrypt, vault_gcpkms_reencrypt, and vault_gcpkms_sign for cryptographic operations. Includes internal Plugin Framework mount_helpers for Vault mount operations to support incremental migration from SDKv2. (#2763)
  • New resource for transform key configurations: vault_transform_key_configuration - Supports setting an auto_rotate_period and min_decryption_version to keys used in for tokenization transformations. This uses this endpoint to modify the configuration and this one to read configurations. (#2980)
  • LDAP Role Level Password Policy Support: Added password_policy parameter to vault_ldap_secret_backend_static_role and vault_ldap_secret_backend_dynamic_role resources to support role-level password policy configuration (#2921). Requires Vault 2.2.0+.
  • LDAP Rotate-on-Read Support: Added rotate_on_read and rotate_on_read_cooldown parameters to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role resources, and rotated_on_read attribute to vault_ldap_static_role_credentials data source to support credential rotation on each read (#2960. Requires Vault Enterprise 2.2.0+.
  • LDAP Account Unlock for Static Role: Added auto_unlock field (Optional+Computed) to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role. When set at the mount level, Vault automatically unlocks the managed AD account after every successful static-role rotation, the per-role field overrides the mount-level setting, and when unset the role inherits the mount default. Active Directory schema only. Requires Vault Enterprise 2.2.0+.(#2977)
  • Terraform Secret Engine Root Rotation Support: Add support for automated root token rotation via the rotation_period, rotation_schedule, rotation_window, and disable_automated_rotation fields, and add explicit_max_ttl to bound the lifetime of the rotated root token. Requires Vault 2.2.0+. (#2958)
  • Add support for Kerberos auth backend: vault_kerberos_auth_backend_config, vault_kerberos_auth_backend_ldap_config, and vault_kerberos_auth_backend_group resources, and vault_kerberos_auth_backend_login ephemeral resource for Kerberos authentication. (#2819)
  • Secrets Sync customer controlled encryption: vault_secrets_sync_aws_destination and vault_secrets_sync_gcp_destination now support Vault 2.2.0+ fields kms_key_id and replica_regions; and deprecated GCP legacy fields global_kms_key, locational_kms_keys, and replication_locations in favor of kms_key_id and replica_regions. (#2965)
  • Add support for pkcs12_bundle and jks_bundle formats (without setting default values) in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2946). Requires Vault 2.0.5+.

IMPROVEMENTS:

  • Migrated AWS provider dependency from aws-sdk-go (v1) to aws-sdk-go-v2 for improved performance and maintainability. (#2882)
  • vault_identity_entity_alias: Add support for external_id and issuer fields. Available only for Vault Enterprise. (#2994)
  • vault_aws_auth_backend_config_identity: Add support for canonical_arn as a valid value for the iam_alias parameter. Requires Vault 1.16+. (#2982)
  • vault_jwt_auth_backend: Add string-to-integer conversion for groups_cap field in provider_config to support Okta provider configuration. (#2939)
  • Autosnapshot support for AWS IRSA: Added documentation for IRSA usage per changes in Vault (hashicorp/raft-snapshotagent#49). IRSA feature requires Vault 2.2.0+
  • Updated dependencies:
    • Bumped 13 Go module dependencies (#2969)
    • Bumped 10 Go module dependencies (#2990)
    • actions/checkout v7.0.0 → v7.0.1
    • actions/setup-go v6.4.0 → v7.0.0
    • actions/cache v5.0.5 → v6.1.0
    • golang.org/x/mod v0.37.0 → v0.40.0 (fixes GO-2026-6179, GO-2026-6180)
    • golang.org/x/crypto v0.54.0 → v0.55.0
    • golang.org/x/net v0.57.0 → v0.58.0
    • golang.org/x/text v0.40.0 → v0.41.0
    • golang.org/x/tools v0.47.0 → v0.49.0
    • cloud.google.com/go/iam v1.12.0 → v1.13.0
    • cloud.google.com/go/auth v0.20.0 → v0.23.0
    • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 → v1.23.0
    • github.com/aws/aws-sdk-go-v2 v1.43.0 → v1.43.5
    • github.com/aws/aws-sdk-go-v2/config v1.32.31 → v1.32.36
    • github.com/aws/aws-sdk-go-v2/credentials v1.19.30 → v1.19.35
    • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 → v1.18.36
    • github.com/aws/aws-sdk-go-v2/service/iam v1.56.0 → v1.59.0
    • github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 → v1.45.5
    • github.com/aws/smithy-go v1.27.3 → v1.27.7
    • github.com/hashicorp/terraform-plugin-log v0.10.0 → v0.11.0
    • github.com/moby/moby/client v0.5.0 → v0.5.1
    • google.golang.org/api v0.287.1 → v0.293.0
    • google.golang.org/genproto v0.0.0-20260622175928 → v0.0.0-20260810153831
    • google.golang.org/grpc v1.82.1 → v1.83.0
    • k8s.io/utils v0.0.0-20260617174310 → v0.0.0-20260707023825
  • Build and CI changes:
    • Go 1.26.41.26.6 (fixes GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, GO-2026-6218 in stdlib)

... (truncated)

Commits
  • fcb48e9 Release v5.11.0 preparation (#3001)
  • fc85ee5 build(deps): bump the gomod-backward-compatible group across 1 directory with...
  • 3e389c6 IRSA 2.1.0 -> 2.2.0 (#2998)
  • de1c10d [VAULT-48696] Fix JWT Auth Backend provider_config Perpetual Diff (#2993)
  • f17772c [VAULT-49147] Change Version from 2.1.0 to 2.2.0 (#2996)
  • 5b45544 VAULT-49089: add issuer and external_id fields to aliases (#2994)
  • 69d312f Add auto_unlock for ldap secret engine (#2977)
  • 2f60b00 feat: add vault_transform_key_configuration resource for transform secrets en...
  • a89ca0d secrets/gcpkms: Add GCP KMS secrets engine and key management resources. (#2763)
  • 5c5a495 Add pkcs12_bundle and jks_bundle format support for PKI cert generation (with...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [hashicorp/vault](https://github.com/hashicorp/terraform-provider-vault) to permit the latest version.
- [Release notes](https://github.com/hashicorp/terraform-provider-vault/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-vault/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-vault@v4.0.0...v5.11.0)

---
updated-dependencies:
- dependency-name: hashicorp/vault
  dependency-version: 5.11.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, terraform. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants