Release/1.17.x

.changelog/18329.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+cli: Adds cli support for checking TCP connection for ports. If -ports flag is not given, it will check for
+default ports of consul listed here - https://developer.hashicorp.com/consul/docs/install/ports
+```

.changelog/18994.txt

@@ -12,12 +12,6 @@ environments.
 * The v1 and v2 catalog APIs cannot run concurrently.
 * The Consul UI does not support multi-port services or the v2 catalog API in this release.
 * HCP Consul does not support multi-port services or the v2 catalog API in this release.
-* The v2 API only supports transparent proxy mode where services that have permissions to connect to each other can use
-  Kube DNS to connect.
-
-### Known Issues
-* When using the v2 API with transparent proxy, Kubernetes pods cannot use L7 liveness, readiness, or startup probes.
-
 
 [[Catalog resource controllers]](https://github.com/hashicorp/consul/tree/e6b724d06249d3e62cd75afe3ee6042ba1fd5415/internal/catalog/internal/controllers)
 [[Mesh resource controllers]](https://github.com/hashicorp/consul/tree/e6b724d06249d3e62cd75afe3ee6042ba1fd5415/internal/mesh/internal/controllers)

.changelog/19225.txt

@@ -0,0 +1,9 @@
+```release-note:security
+Upgrade Go to 1.20.10.
+This resolves vulnerability [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+/ [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)(`net/http`).
+```
+```release-note:security
+Update `golang.org/x/net` to v0.17.0 to address [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+/ [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)(`x/net/http2`).
+```

.changelog/19268.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+Mesh Gateways: Fix a bug where replicated and peered mesh gateways with hostname-based WAN addresses fail to initialize.
+```

.changelog/19274.txt

@@ -0,0 +1,3 @@
+```release-note:security
+connect: update supported envoy versions to 1.24.12, 1.25.11, 1.26.6, 1.27.2 to address [CVE-2023-44487](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76)
+```

.changelog/19285.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+ca: Fix bug with Vault CA provider where token renewal goroutines could leak if CA failed to initialize.
+```
+
+```release-note:bug
+ca: Fix bug with Vault CA provider where renewing a retracted token would cause retries in a tight loop, degrading performance.
+```

.changelog/19314.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+raft: upgrade raft-wal library version to 0.4.1.
+```

.changelog/19339.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+connect: Fix bug where uncleanly closed xDS connections would influence connection balancing for too long and prevent envoy instances from starting. Two new configuration fields
+`performance.grpc_keepalive_timeout` and `performance.grpc_keepalive_interval` now exist to allow for configuration on how often these dead connections will be cleaned up.
+```

.changelog/19342.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+Replaces UI Side Nav with Helios Design System Side Nav. Adds dc/partition/namespace searching in Side Nav.
+```

.changelog/19389.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: stop simultaneous usage of -templated-policy and -templated-policy-file when creating a role or token.
+```

.changelog/19414.txt

@@ -0,0 +1,4 @@
+```release-note:security
+Upgrade `google.golang.org/grpc` to 1.56.3.
+This resolves vulnerability [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487).
+```

.changelog/19503.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+wan-federation: Fix a bug where servers wan-federated through mesh-gateways could crash due to overlapping LAN IP addresses.
+```

.changelog/19549.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: clear peer on home logo link
+```

.changelog/19586.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix being able to view peered services from non-default namnespaces
+```

.changelog/19594.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: move nspace and partitions requests into their selector menus
+```

.changelog/19647.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Add `CaseInsensitive` flag to service-routers that allows paths and path prefixes to ignore URL upper and lower casing.
+```

.changelog/19663.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Default `stats_flush_interval` to 60 seconds when using the Consul Telemetry Collector, unless custom stats sink are present or an explicit flush interval is configured.
+```

.changelog/19666.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Add support for listing ACL tokens by service name when using templated policies.
+```

.changelog/19679.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+CLI: fix a panic when deleting a non existing policy by name.
+```

.changelog/19682.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cloud: push additional server TLS metadata to HCP
+```

.changelog/19705.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Update `github.com/golang-jwt/jwt/v4` to v4.5.0 to address [PRISMA-2022-0270](https://github.com/golang-jwt/jwt/issues/258).
+```

.changelog/19721.txt

@@ -0,0 +1,6 @@
+```release-note:improvement
+metrics: modify consul.client.rpc metric to exclude internal retries for consistency with consul.client.rpc.exceeded and consul.client.rpc.failed
+```
+```release-note:improvement
+metrics: increment consul.client.rpc.failed if RPC fails because no servers are accessible
+```

.changelog/19728.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+acl: add api-gateway templated policy
+```

.changelog/19735.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+acl: add templated policy descriptions
+```

.changelog/19795.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+wan-federation: use a hash to diff config entries when replicating in the secondary DC to avoid unnecessary writes..
+```

.changelog/19821.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+cli: Adds new subcommand `peering exported-services` to list services exported to a peer . Refer to the [CLI docs](https://developer.hashicorp.com/consul/commands/peering) for more information.
+```

.changelog/19827.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+acl: Adds nomad client templated policy
+```

.changelog/19829.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+mesh: parse the proxy-defaults protocol when write the config-entry to avoid parsing it when compiling the discovery chain.
+```

.changelog/19840.txt

@@ -0,0 +1,7 @@
+```release-note:security
+Upgrade to use Go 1.20.12. This resolves CVEs
+[CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283): (`path/filepath`) recognize \??\ as a Root Local Device path prefix (Windows)
+[CVE-2023-45284](https://nvd.nist.gov/vuln/detail/CVE-2023-45285): recognize device names with trailing spaces and superscripts (Windows)
+[CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326): (`net/http`) limit chunked data overhead
+[CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285): (`cmd/go`) go get may unexpectedly fallback to insecure git 
+```

.changelog/19860.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Solves an issue where two upstream services with the same name in different namespaces were not getting routed to correctly by API Gateways.
+```

.changelog/19866.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: ensure child resources are re-sent to Envoy when the parent is updated even if the child already has pending updates.
+```

.changelog/19871.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: Add configurable `xds_fetch_timeout_ms` option to proxy registrations that allows users to prevent endpoints from dropping when they have proxies with a large number of upstreams.
+```

.changelog/19907.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: stop manually reconciling services if peering is enabled
+```

.changelog/19912.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: update token list on Role details page to show only linked tokens
+```

.changelog/19940.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+xds: remove usages of deprecated Envoy fields: `envoy.config.cluster.v3.Cluster.http2_protocol_options`, `envoy.config.bootstrap.v3.Admin.access_log_path`
+```

.changelog/19943.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+cli: Deprecate the `-admin-access-log-path` flag from `consul connect envoy` command in favor of: `-admin-access-log-config`.
+```

.changelog/19954.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Remove usage of deprecated Envoy field `match_subject_alt_names` in favor of `match_typed_subject_alt_names`.
+```

.changelog/20010.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+xds: Replace usage of deprecated Envoy field `envoy.config.cluster.v3.Cluster.http_protocol_options`
+```

.changelog/20011.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: replace usage of deprecated Envoy field `envoy.config.router.v3.WeightedCluster.total_weight`.
+```

.changelog/20012.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+xds: replace usage of deprecated Envoy field `envoy.extensions.filters.http.lua.v3.Lua.inline_code`
+```

.changelog/20014.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Upgrade OpenShift container images to use `ubi9-minimal:9.3` as the base image.
+```

.changelog/20015.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: add a new api(/v1/exported-services) to list all the exported service and their consumers. 
+```

.changelog/20062.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+Upgrade to use Go 1.21.6.
+```

.changelog/20111.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+UI: fix autofocus on search box when page refreshes on typing in it due to url change.
+```

.changelog/20112.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Update RSA key generation to use a key size of at least 2048 bits.
+```

.changelog/20168.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+ProxyCfg: avoid setting a watch on `Internal.ServiceDump` when mesh gateway is not used.
+```
+
+```release-note:enhancement
+ProxyCfg: only return the nodes list when querying the `Internal.ServiceDump` watch from proxycfg
+```

.changelog/20331.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+cli: Adds new command `exported-services` to list all services exported and their consumers. Refer to the [CLI docs](https://developer.hashicorp.com/consul/commands/exported-services) for more information.
+```

.changelog/20345.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+  audit-logs: **(Enterprise Only)** Fixes non ASCII characters in audit logs because of gzip.
+```

.changelog/20352.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+logging: add /api prefix to v2 resource endpoint logs
+```

.changelog/20406.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+mesh: Fix bug where envoy extensions could not be configured with "permissive" mTLS mode. Note that envoy extensions currently do not apply to non-mTLS traffic in permissive mode.
+```

.changelog/20417.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix regression with SAN matching on terminating gateways [GH-20360](https://github.com/hashicorp/consul/issues/20360)
+```

.changelog/20439.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docs: Consul DNS Forwarding configuration for OpenShift update for [Resolve Consul DNS Requests in Kubernetes](https://developer.hashicorp.com/consul/docs/k8s/dns)
+```

.changelog/20481.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix issue where re-persisting existing proxy-defaults using `http` protocol fails with a protocol-mismatch error.
+```

.changelog/20511.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Remove code coupling where the xDS capacity controller could negatively affect raft autopilot performance.
+```

.changelog/20545.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+Upgrade to use Go 1.21.7.
+```

.changelog/20587.txt

@@ -0,0 +1,3 @@
+```release-note:security
+mesh: Update Envoy versions to 1.27.3 and 1.26.7 to address [CVE-2024-23324](https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6), [CVE-2024-23325](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5m7c-mrwr-pm26), [CVE-2024-23322](https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38), [CVE-2024-23323](https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch), [CVE-2024-23327](https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j), and [CVE-2023-44487](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76)
+```

.changelog/20679.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+dns: SERVFAIL when resolving not found PTR records.
+```

.changelog/20801.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Update `google.golang.org/protobuf` to v1.33.0 to address [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786).
+```

.changelog/20812.txt

@@ -0,0 +1,14 @@
+```release-note:security
+Upgrade to use Go `1.21.8`. This resolves CVEs
+[CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783) (`crypto/x509`).
+[CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290) (`net/http`).
+[CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289) (`net/http`, `net/http/cookiejar`).
+[CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785) (`html/template`).
+[CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784) (`net/mail`).
+```
+
+```release-note:security
+Update the Consul Build Go base image to `alpine3.19`. This resolves CVEs
+[CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)
+[CVE-2023-52426⁠](https://nvd.nist.gov/vuln/detail/CVE-2023-52426)
+```

.changelog/20897.txt

@@ -0,0 +1,3 @@
+```release-note:security
+ Bump Dockerfile base image to `alpine:3.19`. 
+ ```

.changelog/20956.txt

@@ -0,0 +1,14 @@
+```release-note:security
+Upgrade to use Go `1.21.9`. This resolves CVE
+[CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288) (`http2`).
+```
+
+```release-note:security
+Upgrade to support Envoy `1.26.8 and 1.27.4`. This resolves CVE
+[CVE-2024-27919](https://nvd.nist.gov/vuln/detail/CVE-2024-27919) (`http2`).
+```
+
+```release-note:security
+Upgrade to use golang.org/x/net `v0.24.0`. This resolves CVE
+[CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288) (`x/net`).
+```

.changelog/21033.txt

@@ -0,0 +1,9 @@
+```release-note:security
+Upgrade to support Envoy `1.27.5 and 1.28.3`. This resolves CVE
+[CVE-2024-32475](https://nvd.nist.gov/vuln/detail/CVE-2024-32475) (`auto_sni`).
+```
+
+```release-note:security
+Upgrade to support k8s.io/apimachinery `v0.18.7 or higher`. This resolves CVE
+[CVE-2020-8559](https://nvd.nist.gov/vuln/detail/CVE-2020-8559).
+```

.changelog/_20721.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ingress-gateway: **(Enterprise Only)** Fix a bug where on update, Ingress Gateways lost all upstreams for listeners with wildcard services in a different namespace.
+```

.changelog/_7406.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+server: **(Enterprise Only)** Fixed an issue where snake case keys were rejected when configuring the control-plane-request-limit config entry
+```

.changelog/_7773.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+prepared-query: (Enterprise-only) Fix issue where sameness-group failover targets to peers would attempt to query data from the default partition, rather than the sameness-group's partition always.
+```

.copywrite.hcl

@@ -2,7 +2,7 @@ schema_version = 1
 
 project {
   license        = "BUSL-1.1"
-  copyright_year = 2023
+  copyright_year = 2024
 
   # (OPTIONAL) A list of globs that should not have copyright/license headers.
   # Supports doublestar glob patterns for more flexibility in defining which

.github/scripts/set_test_package_matrix.sh

@@ -6,6 +6,6 @@ set -euo pipefail
 export RUNNER_COUNT=$1
 
 # set matrix var to list of unique packages containing tests
-matrix="$(go list -json="ImportPath,TestGoFiles" ./... | jq --compact-output '. | select(.TestGoFiles != null) | .ImportPath' | jq --slurp --compact-output '.' | jq --argjson runnercount $RUNNER_COUNT  -cM '[_nwise(length / $runnercount | floor)]'))"
+matrix="$(go list -json="ImportPath,TestGoFiles" ./... | jq --compact-output '. | select(.TestGoFiles != null) | .ImportPath' | shuf | jq --slurp --compact-output '.' | jq --argjson runnercount $RUNNER_COUNT  -cM '[_nwise(length / $runnercount | floor)]'))"
 
 echo "matrix=${matrix}" >> "${GITHUB_OUTPUT}"