Consul - v1.15.5

1.15.5 (August 7, 2023)

SECURITY:

• Update golang.org/x/net to v0.13.0 to address CVE-2023-3978. [GH-18358]
• Upgrade golang.org/x/net to address CVE-2023-29406 [GH-18186]
• Upgrade to use Go 1.20.6.
  This resolves CVE-2023-29406(net/http) for uses of the standard library.
  A separate change updates dependencies on golang.org/x/net to use 0.12.0. [GH-18190]
• Upgrade to use Go 1.20.7.
  This resolves vulnerability CVE-2023-29409(crypto/tls). [GH-18358]

FEATURES:

• cli: consul members command uses -filter expression to filter members based on bexpr. [GH-18223]
• cli: consul watch command uses -filter expression to filter response from checks, services, nodes, and service. [GH-17780]
• reloadable config: Made enable_debug config reloadable and enable pprof command to work when config toggles to true [GH-17565]

IMPROVEMENTS:

• Fix some typos in metrics docs [GH-18080]
• acl: added builtin ACL policy that provides global read-only access (builtin/global-read-only) [GH-18319]
• acl: allow for a single slash character in policy names [GH-18319]
• connect: Add capture group labels from Envoy cluster FQDNs to Envoy exported metric labels [GH-17888]
• connect: update supported envoy versions to 1.22.11, 1.23.12, 1.24.10, 1.25.9 [GH-18304]
• hcp: Add dynamic configuration support for the export of server metrics to HCP. [GH-18168]
• hcp: Removes requirement for HCP to provide a management token [GH-18140]
• xds: Explicitly enable WebSocket connection upgrades in HTTP connection manager [GH-18150]

BUG FIXES:

• Fix a bug that wrongly trims domains when there is an overlap with DC name. [GH-17160]
• api-gateway: fix race condition in proxy config generation when Consul is notified of the bound-api-gateway config entry before it is notified of the api-gateway config entry. [GH-18291]
• connect/ca: Fixes a bug preventing CA configuration updates in secondary datacenters [GH-17846]
• connect: Fix incorrect protocol config merging for transparent proxy implicit upstreams. [GH-17894]
• connect: Removes the default health check from the consul connect envoy command when starting an API Gateway.
  This health check would always fail. [GH-18011]
• connect: fix a bug with Envoy potentially starting with incomplete configuration by not waiting enough for initial xDS configuration. [GH-18024]
• snapshot: fix access denied and handle is invalid when we call snapshot save on windows - skip sync() for folders in windows in
  https://github.com/rboyer/safeio/pull/3 [GH-18302]