Skip to content

chore(deps): update dependency openbao/openbao to v2.5.5#355

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/openbao-openbao-2.x
Open

chore(deps): update dependency openbao/openbao to v2.5.5#355
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/openbao-openbao-2.x

Conversation

@renovate

@renovate renovate Bot commented Feb 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
openbao/openbao minor v2.4.4 → v2.5.5

Release Notes

openbao/openbao (openbao/openbao)

v2.5.5

Compare Source

SECURITY

BUG FIXES

  • core/ha: Return to read-enabled standby mode instead of read-disabled standby mode after stepping down from active mode when standby reads are enabled. This also fixes SIGHUPs crashing standby nodes if they've previously stepped down from active. [GH-3223]
  • auth/mfa: Correctly forward two-phase MFA validations on standby nodes. [GH-3246]
  • sys/namespaces: Support clearing a namespace's custom_metadata by providing a patch that sets custom_metadata to null at the top-level. [GH-3273]
  • sys/plugins: Fix /sys/plugins/catalog and /sys/plugins/catalog/<type> not returning versioned plugins. [GH-3186]

What's Changed

Full Changelog: openbao/openbao@v2.5.4...v2.5.5

v2.5.4

Compare Source

SECURITY

IMPROVEMENTS

  • storage/postgresql: Set constraint name to table+"_pkey" and ha_table+"_pkey" and index to table+"_idx" for uniqueness when reusing the same database partition for multiple OpenBao instances. [GH-2876]

BUG FIXES

  • auth/kerberos: Do not return logical.Auth{} response during initial negotiation at the same time as an error. [GH-3150]
  • core/mfa: Handle invalidation for login MFA, ensuring standby nodes respond appropriately on writes. [GH-3083]
  • core/policies: Fix list_scan_response_keys_filter_path incorrectly erring on empty list responses. [GH-3063]
  • core/quotas: Correctly handle default rate limit exempt paths on quota configuration invalidation. [GH-2953]
  • core: Disallow logical secret engines from creating authentication tokens. [GH-3087]
  • core: Forward generate-root, step-down and rekey requests to active node to resolve inconsistent standby behavior. [GH-3006]
  • storage/raft: Wait for autopilot shutdown to avoid panic when racing to retrieve known servers. [GH-3054]
  • storage/postgresql: Revert accidental rename of ha_table option to haTable. Both spellings are now supported to retain compatibility, though ha_table takes precedence. [GH-2876]

What's Changed

Full Changelog: openbao/openbao@v2.5.3...v2.5.4

v2.5.3

Compare Source

SECURITY

BUG FIXES

  • command/server: Refuse repeated startup if self-initialization failed on initial run. [GH-2908]
  • core: Fix namespace invalidation on standby when disable_cache=true is set. [GH-2822]
  • core: Loosen overly strict check for view path check, strictly forbidding .. as a substring within path segments. [GH-2910]
  • secret/database, secret/openldap, secret/rabbitmq: Fix dynamic secret requests failing with an "Internal Server Error" on standby nodes [GH-2853]

What's Changed

Full Changelog: openbao/openbao@v2.5.2...v2.5.3

v2.5.2

Compare Source

SECURITY

  • auth/jwt: Prevent XSS via error_description parameter in callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  • auth/jwt: Prompt for confirmation during direct callback mode to authorize OpenBao token issuance. CVE-2026-33757. [GH-2710]

BUG FIXES

  • command: External token helpers now inherit environment variables from the parent process. [GH-2570]
  • core/metrics: Fix count of leases/tokens/kv-secrets/entities metric not being emitted. [GH-2672]
  • core/mounts, core/namespaces: Fix lock ordering in mount deletion racing against namespace updates, causing deadlocks. [GH-2625]
  • core/seal: Fix /sys/rotate/root call rotating both root key and unseal key when using a Shamir Seal, losing all key shares. [GH-2619]
  • core: Skip re-scheduling lease expiration jobs that need to write to storage when a node unseals in read-only mode. [GH-2549]
  • core: Fix potential deadlock in JobManager, which can cause mount deletion timeouts. [GH-2630]
  • http: Forward help requests to active node when unable to handle them on standby with read requests handling disabled. [GH-2572]
  • identity/oidc: Fix OIDC named key rotation silently skipping in non-root namespaces due to double namespace prefix in storage path lookup. [GH-2669]
  • raft: Propagate peer join/remove/promote/demote and autopilot read/update requests to active node. [GH-2574]

What's Changed

Full Changelog: openbao/openbao@v2.5.1...v2.5.2

v2.5.1

Compare Source

SECURITY

BUG FIXES

  • seal: Fix Auto Unseal failing when upgrading to v2.5.0 or downgrading from v2.5.0 to an earlier version. This affected the following providers: AliCloud KMS, AWS KMS, Azure Key Vault, GCP Cloud KMS & OCI KMS. [GH-2505]
  • core/mounts: Don't attempt to upgrade legacy mount tables when in read-only standby mode. [GH-2467]
  • core/expiration: Fix total lease count not being decremented when revoking irrevocable leases. [GH-2414]
  • pki: Fix "context canceled" issue when processing cache invalidation, leading to pki returning 500 until reload. [GH-2472]
  • command: Fix panic when the home directory cannot be trivially deduced via environment variables. [GH-2446]

CHANGES

  • core/identity: Remove pre-v2.5.0 corrupt namespace identity groups during unseal; corrupt groups need to be recreated by an admin. Check for deleting corrupt group in server startup logs. [GH-2454]

What's Changed

Full Changelog: openbao/openbao@v2.5.0...v2.5.1

v2.5.0

Compare Source

[!TIP]
This release adds support for horizontal read scalability!

SECURITY
  • core/sys: BREAKING: default value of disable_unauthed_rekey_endpoints is true, to continue using unauthed rekey endpoints, set disable_unauthed_rekey_endpoints=false in listeners explicitly. [GH-2125]
CHANGES
  • Remove the deprecated creation_statements, revocation_statements, rollback_statements, and renew_statements fields from the dbplugin Statements protobuf message [GH-1962]
  • api: The deprecated api.MountConfigOutput.PluginName field was removed. This was already always empty. [GH-2036]
  • auth/jwt: Return error msg on OIDCDiscoveryURL including .well-known/openid-configuration component. [GH-2066]
  • core/audit: removed jsonx as a output format option for audit mounts [GH-2047]
  • sys/host-info: This endpoint may start reporting slightly higher memory usage than before (On Linux only). See https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for more information. [GH-1887]
FEATURES
  • Add declarative plugin distribution via OCI images: using the plugin configuration keyword.
    • Plugins can be automatically downloaded via the plugin_auto_download=true option.
    • Plugins can be manually downloaded via the bao plugin init command.
    • Plugins can be automatically registered via the plugin_auto_register=true option, regardless if they were manually provisioned or from OCI images. [GH-1824]
  • Support Horizontal Read Scalability: all existing HA standby nodes are automatically upgraded with read support.
    • Requests which only perform storage read operations will be handled locally on the standby node.
    • Requests which perform a storage write operation (or as indicated by plugins) are forwarded to the active leader.
    • Results are eventually consistent: a write may not be immediately visible on the standby.
    • To disable, set disable_standby_reads=true in the config file before startup. [GH-1986]
  • OIDC Provider: Add Client Credentials flow to OIDC Provider. [GH-1732]
  • sdk/framework: add Response.SchemaName to allow custom response schema names in the generated OpenAPI spec. [GH-1714]
IMPROVEMENTS
  • audit: Add http audit device for low-volume, webhook-based audit event reporting. [GH-1709]
  • auth/jwt: Add type checking to role. [GH-1854]
  • command: Add environment variables to provide configuration for Proxy, Agent, and bao operator migrate via BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  • command: Support BAO_CONFIG_PATH in plugin init, just like server &c do. [GH-2164]
  • command: server, operator diagnose and 'operator validate-config` now support the environment variable BAO_CONFIG_FILE for the -config command option. [GH-2115]
  • core/metrics: Support custom path for metrics on metrics-only listeners. [GH-1853]
  • core/namespaces: Use JobManager for namespace deletion, decreasing lock contention. [GH-2226]
  • core/policies: Add endpoint to allow detailed listing of a subset of policies. [GH-1965]
  • core/policies: Use per-namespace write lock, improving parallelism. [GH-2226]
  • core: Added metrics_only and disallow_metrics options to control metrics endpoint exposure on a per-listener basis. [GH-1834]
  • database/valkey: Adds the ability to configure the Valkey database connection using a single connection_url parameter. [GH-1923]
  • database: all database plugins now ignore "not found" errors on revoke by default. See Plugin Author Guide for rationale. [GH-2101]
  • openapi: Add response schemas for token store operations and update operation suffixes. [GH-1840]
  • pki: add allowed_ip_sans_cidr parameter to PKI role system, to provide additional checks for IP SANs. [GH-1833]
  • storage/postgresql: implement physical.FencingHABackend to minimize chances that writes on secondary nodes occur. [GH-1571]
  • transit: Add associated_data parameter to generate data key. [GH-1828]
  • website: Add an example of current role statement from Valkey. [GH-1811]
DEPRECATIONS
  • core/seal: Remove the undocumented "aead" seal mechanism. Consider switching to the static seal instead as a replacement. [GH-1910]
  • core: Removed FeatureFlags parsing and related code. [GH-2045]
  • sdk: Removed sdk/v2/helper/license package. [GH-2045]
  • ui: Removed internal/ui/feature-flags endpoint and all its usage. [GH-2045]
BUG FIXES
  • agent/auth: Fix token reissue error with kerberos method. [GH-2373]
  • auth/jwt: Fix ordering of variable declarations in CEL program roles. [GH-1854]
  • core/identity: Ensure periodic func only operates on a single namespace at a time, decreasing storage contention. [GH-2226]
  • core/identity: fix corrupt data being stored when referencing member_group_ids across namespaces (requires unsafe_cross_namespace_identity=true) [GH-2321]
  • core/namespaces: Ensure namespace creation is interruptable, allowing namespace deletion for cleanup. [GH-2226]
  • core/namespaces: Fix deadlock on namespace creation, deletion due to transaction/lock ordering. [GH-2226]
  • core/namespaces: Fix storage failures in namespace creation leading to a total system deadlock. [GH-2166]
  • core/namespaces: improve recovery from partial deletion of namespaces, preventing server startup failure. [GH-2188]
  • database/valkey: The creation_statements parameter now correctly accepts a standard array of strings for ACL rules (e.g., ["+@&#8203;read", "~*"]). Previously, it incorrectly required a stringified JSON array. The old format is still supported for backward compatibility. [GH-1959]
  • helper/jobmanager: Fix queue length metrics to report as gauges. [GH-2226]
  • physical/postgresql: ensure underlying HA lock removal from database causes lock loss, write failures. [GH-2100]
  • raft: return correct raft leader id from read replica nodes when using bao operator raft list-peers. [GH-2331]
  • sdk/logical: Use created transaction for WithTransaction callback. [GH-2226]
  • secrets/pki: Fix ordering of variable declarations in CEL program roles. [GH-1854]

What's Changed over Beta

Release notes: https://openbao.org/docs/release-notes/2-5-0/#v250
Full Changelog: openbao/openbao@v2.4.0...v2.5.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented Feb 4, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate renovate Bot force-pushed the renovate/openbao-openbao-2.x branch from 1bf9152 to 72ecf65 Compare February 12, 2026 11:47
@renovate renovate Bot force-pushed the renovate/openbao-openbao-2.x branch from 72ecf65 to fcef301 Compare February 23, 2026 19:12
@renovate renovate Bot changed the title chore(deps): update dependency openbao/openbao to v2.5.0 chore(deps): update dependency openbao/openbao to v2.5.1 Feb 23, 2026
@renovate renovate Bot force-pushed the renovate/openbao-openbao-2.x branch from fcef301 to d8b4e4a Compare March 25, 2026 17:56
@renovate renovate Bot changed the title chore(deps): update dependency openbao/openbao to v2.5.1 chore(deps): update dependency openbao/openbao to v2.5.2 Mar 25, 2026
@renovate renovate Bot force-pushed the renovate/openbao-openbao-2.x branch from d8b4e4a to e91997c Compare April 20, 2026 20:39
@renovate renovate Bot changed the title chore(deps): update dependency openbao/openbao to v2.5.2 chore(deps): update dependency openbao/openbao to v2.5.3 Apr 20, 2026
@renovate renovate Bot force-pushed the renovate/openbao-openbao-2.x branch 2 times, most recently from 92e1e5e to 5f5d7cd Compare May 20, 2026 18:39
@renovate renovate Bot changed the title chore(deps): update dependency openbao/openbao to v2.5.3 chore(deps): update dependency openbao/openbao to v2.5.4 May 20, 2026
@renovate renovate Bot force-pushed the renovate/openbao-openbao-2.x branch from 5f5d7cd to 43bfd0f Compare June 17, 2026 19:45
@renovate renovate Bot changed the title chore(deps): update dependency openbao/openbao to v2.5.4 chore(deps): update dependency openbao/openbao to v2.5.5 Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants