Skip to content

chore(deps): update dependency openbao/openbao to v2.5.2#355

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/openbao-openbao-2.x
Open

chore(deps): update dependency openbao/openbao to v2.5.2#355
renovate[bot] wants to merge 1 commit intomainfrom
renovate/openbao-openbao-2.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 4, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
openbao/openbao minor v2.4.4 → v2.5.2

Release Notes

openbao/openbao (openbao/openbao)

v2.5.2

Compare Source

SECURITY

  • auth/jwt: Prevent XSS via error_description parameter in callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  • auth/jwt: Prompt for confirmation during direct callback mode to authorize OpenBao token issuance. CVE-2026-33757. [GH-2710]

BUG FIXES

  • command: External token helpers now inherit environment variables from the parent process. [GH-2570]
  • core/metrics: Fix count of leases/tokens/kv-secrets/entities metric not being emitted. [GH-2672]
  • core/mounts, core/namespaces: Fix lock ordering in mount deletion racing against namespace updates, causing deadlocks. [GH-2625]
  • core/seal: Fix /sys/rotate/root call rotating both root key and unseal key when using a Shamir Seal, losing all key shares. [GH-2619]
  • core: Skip re-scheduling lease expiration jobs that need to write to storage when a node unseals in read-only mode. [GH-2549]
  • core: Fix potential deadlock in JobManager, which can cause mount deletion timeouts. [GH-2630]
  • http: Forward help requests to active node when unable to handle them on standby with read requests handling disabled. [GH-2572]
  • identity/oidc: Fix OIDC named key rotation silently skipping in non-root namespaces due to double namespace prefix in storage path lookup. [GH-2669]
  • raft: Propagate peer join/remove/promote/demote and autopilot read/update requests to active node. [GH-2574]

What's Changed

Full Changelog: openbao/openbao@v2.5.1...v2.5.2

v2.5.1

Compare Source

SECURITY

BUG FIXES

  • seal: Fix Auto Unseal failing when upgrading to v2.5.0 or downgrading from v2.5.0 to an earlier version. This affected the following providers: AliCloud KMS, AWS KMS, Azure Key Vault, GCP Cloud KMS & OCI KMS. [GH-2505]
  • core/mounts: Don't attempt to upgrade legacy mount tables when in read-only standby mode. [GH-2467]
  • core/expiration: Fix total lease count not being decremented when revoking irrevocable leases. [GH-2414]
  • pki: Fix "context canceled" issue when processing cache invalidation, leading to pki returning 500 until reload. [GH-2472]
  • command: Fix panic when the home directory cannot be trivially deduced via environment variables. [GH-2446]

CHANGES

  • core/identity: Remove pre-v2.5.0 corrupt namespace identity groups during unseal; corrupt groups need to be recreated by an admin. Check for deleting corrupt group in server startup logs. [GH-2454]

What's Changed

Full Changelog: openbao/openbao@v2.5.0...v2.5.1

v2.5.0

Compare Source

[!TIP]
This release adds support for horizontal read scalability!

SECURITY
  • core/sys: BREAKING: default value of disable_unauthed_rekey_endpoints is true, to continue using unauthed rekey endpoints, set disable_unauthed_rekey_endpoints=false in listeners explicitly. [GH-2125]
CHANGES
  • Remove the deprecated creation_statements, revocation_statements, rollback_statements, and renew_statements fields from the dbplugin Statements protobuf message [GH-1962]
  • api: The deprecated api.MountConfigOutput.PluginName field was removed. This was already always empty. [GH-2036]
  • auth/jwt: Return error msg on OIDCDiscoveryURL including .well-known/openid-configuration component. [GH-2066]
  • core/audit: removed jsonx as a output format option for audit mounts [GH-2047]
  • sys/host-info: This endpoint may start reporting slightly higher memory usage than before (On Linux only). See https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for more information. [GH-1887]
FEATURES
  • Add declarative plugin distribution via OCI images: using the plugin configuration keyword.
    • Plugins can be automatically downloaded via the plugin_auto_download=true option.
    • Plugins can be manually downloaded via the bao plugin init command.
    • Plugins can be automatically registered via the plugin_auto_register=true option, regardless if they were manually provisioned or from OCI images. [GH-1824]
  • Support Horizontal Read Scalability: all existing HA standby nodes are automatically upgraded with read support.
    • Requests which only perform storage read operations will be handled locally on the standby node.
    • Requests which perform a storage write operation (or as indicated by plugins) are forwarded to the active leader.
    • Results are eventually consistent: a write may not be immediately visible on the standby.
    • To disable, set disable_standby_reads=true in the config file before startup. [GH-1986]
  • OIDC Provider: Add Client Credentials flow to OIDC Provider. [GH-1732]
  • sdk/framework: add Response.SchemaName to allow custom response schema names in the generated OpenAPI spec. [GH-1714]
IMPROVEMENTS
  • audit: Add http audit device for low-volume, webhook-based audit event reporting. [GH-1709]
  • auth/jwt: Add type checking to role. [GH-1854]
  • command: Add environment variables to provide configuration for Proxy, Agent, and bao operator migrate via BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  • command: Support BAO_CONFIG_PATH in plugin init, just like server &c do. [GH-2164]
  • command: server, operator diagnose and 'operator validate-config` now support the environment variable BAO_CONFIG_FILE for the -config command option. [GH-2115]
  • core/metrics: Support custom path for metrics on metrics-only listeners. [GH-1853]
  • core/namespaces: Use JobManager for namespace deletion, decreasing lock contention. [GH-2226]
  • core/policies: Add endpoint to allow detailed listing of a subset of policies. [GH-1965]
  • core/policies: Use per-namespace write lock, improving parallelism. [GH-2226]
  • core: Added metrics_only and disallow_metrics options to control metrics endpoint exposure on a per-listener basis. [GH-1834]
  • database/valkey: Adds the ability to configure the Valkey database connection using a single connection_url parameter. [GH-1923]
  • database: all database plugins now ignore "not found" errors on revoke by default. See Plugin Author Guide for rationale. [GH-2101]
  • openapi: Add response schemas for token store operations and update operation suffixes. [GH-1840]
  • pki: add allowed_ip_sans_cidr parameter to PKI role system, to provide additional checks for IP SANs. [GH-1833]
  • storage/postgresql: implement physical.FencingHABackend to minimize chances that writes on secondary nodes occur. [GH-1571]
  • transit: Add associated_data parameter to generate data key. [GH-1828]
  • website: Add an example of current role statement from Valkey. [GH-1811]
DEPRECATIONS
  • core/seal: Remove the undocumented "aead" seal mechanism. Consider switching to the static seal instead as a replacement. [GH-1910]
  • core: Removed FeatureFlags parsing and related code. [GH-2045]
  • sdk: Removed sdk/v2/helper/license package. [GH-2045]
  • ui: Removed internal/ui/feature-flags endpoint and all its usage. [GH-2045]
BUG FIXES
  • agent/auth: Fix token reissue error with kerberos method. [GH-2373]
  • auth/jwt: Fix ordering of variable declarations in CEL program roles. [GH-1854]
  • core/identity: Ensure periodic func only operates on a single namespace at a time, decreasing storage contention. [GH-2226]
  • core/identity: fix corrupt data being stored when referencing member_group_ids across namespaces (requires unsafe_cross_namespace_identity=true) [GH-2321]
  • core/namespaces: Ensure namespace creation is interruptable, allowing namespace deletion for cleanup. [GH-2226]
  • core/namespaces: Fix deadlock on namespace creation, deletion due to transaction/lock ordering. [GH-2226]
  • core/namespaces: Fix storage failures in namespace creation leading to a total system deadlock. [GH-2166]
  • core/namespaces: improve recovery from partial deletion of namespaces, preventing server startup failure. [GH-2188]
  • database/valkey: The creation_statements parameter now correctly accepts a standard array of strings for ACL rules (e.g., ["+@​read", "~*"]). Previously, it incorrectly required a stringified JSON array. The old format is still supported for backward compatibility. [GH-1959]
  • helper/jobmanager: Fix queue length metrics to report as gauges. [GH-2226]
  • physical/postgresql: ensure underlying HA lock removal from database causes lock loss, write failures. [GH-2100]
  • raft: return correct raft leader id from read replica nodes when using bao operator raft list-peers. [GH-2331]
  • sdk/logical: Use created transaction for WithTransaction callback. [GH-2226]
  • secrets/pki: Fix ordering of variable declarations in CEL program roles. [GH-1854]

What's Changed over Beta

Release notes: https://openbao.org/docs/release-notes/2-5-0/#v250
Full Changelog: openbao/openbao@v2.4.0...v2.5.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov
Copy link
Copy Markdown

codecov bot commented Feb 4, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate renovate bot force-pushed the renovate/openbao-openbao-2.x branch from 1bf9152 to 72ecf65 Compare February 12, 2026 11:47
@renovate renovate bot force-pushed the renovate/openbao-openbao-2.x branch from 72ecf65 to fcef301 Compare February 23, 2026 19:12
@renovate renovate bot changed the title chore(deps): update dependency openbao/openbao to v2.5.0 chore(deps): update dependency openbao/openbao to v2.5.1 Feb 23, 2026
@renovate renovate bot force-pushed the renovate/openbao-openbao-2.x branch from fcef301 to d8b4e4a Compare March 25, 2026 17:56
@renovate renovate bot changed the title chore(deps): update dependency openbao/openbao to v2.5.1 chore(deps): update dependency openbao/openbao to v2.5.2 Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants