v1.20.0-rc2

[VAULT-37186] This is an automated pull request to build all artifact…

v1.20.0-rc1

1.20.0-rc1

June 11, 2025

SECURITY:

• core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [GH-30794]

CHANGES:

• UI: remove outdated and unneeded js string extensions [GH-29834]
• activity (enterprise): The sys/internal/counters/activity endpoint will return actual values for new clients in the current month.
• activity (enterprise): provided values for start_time and end_time in sys/internal/counters/activity are aligned to the corresponding billing period.
• activity: provided value for end_time in sys/internal/counters/activity is now capped at the end of the last completed month. [GH-30164]
• auth/alicloud: Update plugin to v0.21.0 [GH-30810]
• auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
• auth/azure: Update plugin to v0.20.3 [GH-30082]
• auth/azure: Update plugin to v0.20.4 [GH-30543]
• auth/cf: Update plugin to v0.20.1 [GH-30583]
• auth/cf: Update plugin to v0.21.0 [GH-30842]
• auth/gcp: Update plugin to v0.20.2 [GH-30081]
• auth/jwt: Update plugin to v0.23.2 [GH-30431]
• auth/jwt: Update plugin to v0.24.1 [GH-30876]
• auth/kerberos: Update plugin to v0.15.0 [GH-30845]
• auth/kubernetes: Update plugin to v0.22.1 [GH-30910]
• auth/oci: Update plugin to v0.19.0 [GH-30841]
• auth/saml: Update plugin to v0.6.0
• core: Bump Go version to 1.24.4
• core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [GH-29774]
• database/couchbase: Update plugin to v0.14.0 [GH-30836]
• database/elasticsearch: Update plugin to v0.18.0 [GH-30796]
• database/mongodbatlas: Update plugin to v0.15.0 [GH-30856]
• database/redis-elasticache: Update plugin to v0.7.0 [GH-30785]
• database/redis: Update plugin to v0.6.0 [GH-30797]
• database/snowflake: Update plugin to v0.14.0 [GH-30748]
• secrets/ad: Update plugin to v0.21.0 [GH-30819]
• secrets/alicloud: Update plugin to v0.20.0 [GH-30809]
• secrets/azure: Update plugin to v0.21.2 [GH-30037]
• secrets/azure: Update plugin to v0.21.3 [GH-30083]
• secrets/azure: Update plugin to v0.22.0 [GH-30832]
• secrets/gcp: Update plugin to v0.21.2 [GH-29970]
• secrets/gcp: Update plugin to v0.21.3 [GH-30080]
• secrets/gcp: Update plugin to v0.22.0 [GH-30846]
• secrets/gcpkms: Update plugin to v0.21.0 [GH-30835]
• secrets/kubernetes: Update plugin to v0.11.0 [GH-30855]
• secrets/kv: Update plugin to v0.24.0 [GH-30826]
• secrets/openldap: Update plugin to v0.15.2 [GH-30079]
• secrets/openldap: Update plugin to v0.15.4 [GH-30279]
• secrets/openldap: Update plugin to v0.16.0 [GH-30844]
• server: disable_mlock configuration option is now required for integrated storage and no longer has a default. If you are using the default value with integrated storage, you must now explicitly set disable_mlock to true or false or Vault server will fail to start. [GH-29974]
• ui/activity: Replaces mount and namespace attribution charts with a table to allow sorting
  client count data by namespace, mount_path, mount_type or number of clients for
  a selected month. [GH-30678]
• ui: Client count side nav link 'Vault Usage Metrics' renamed to 'Client Usage' [GH-30765]
• ui: Client counting "running total" charts now reflect new clients only [GH-30506]
• ui: Removed FormError component (not used) [GH-34699]
• ui: Selecting a different method in the login form no longer updates the /vault/auth?with= query parameter [GH-30500]
• ui: /vault/auth?with= query parameter now exclusively refers to the auth mount path and renders a simplified form [GH-30500]

FEATURES:

• Auto Irrevocable Lease Removal (Enterprise): Add the Vault Enterprise configuration param, remove_irrevocable_lease_after. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [GH-30703]
• Development Cluster Configuration (enterprise): Added development_cluster as a field to Vault's utilization reports.
  The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [GH-30659]
• Entity-based and collective rate limit quotas (enterprise): Add new group_by field to the rate limit quota API to support different grouping modes.
• Login form customization (enterprise): Adds support to choose a default and/or backup auth methods for the web UI login form to streamline the web UI login experience. [GH-30700]
• Secret Recovery from Snapshot (Enterprise): Adds a framework to load an integrated storage snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot.
• SSH Key Signing Improvements (Enterprise): Add support for using managed keys to sign SSH keys in the SSH secrets engine.
• UI Secrets Engines: TOTP secrets engine is now supported. [GH-29751]
• UI Telemetry: add Posthog for UI telemetry tracking on HashiCorp Cloud-managed clusters [GH-30425]
• Vault Namespace Picker: Updating the Vault Namespace Picker to enable search functionality, allow direct navigation to nested namespaces and improve accessibility. [GH-30490]
• Vault PKI SCEP Server (Enterprise): Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.

IMPROVEMENTS:

• activity (enterprise): Added vault.client.billing_period.activity telemetry metric to emit information about the total number of distinct clients used in the current billing period.
• activity: mount_type was added to the API response of sys/internal/counters/activity [GH-30071]
• api (enterprise): Added a new API, /sys/utilization-report, giving a snapshot overview of Vault's utilization at a high level.
• api/client: Add Cert auth method support. This allows the client to authenticate using a client certificate. [GH-29546]
• core (enterprise): allow a root token to relock a namespace locked by the Namespace API Lock feature.
• core (enterprise): Updated code and documentation to support FIPS 140-3 compliant algorithms.
• core (enterprise): report errors from the underlying seal when getting entropy.
• core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
• core/metrics: added a new telemetry metric, vault.core.response_status_code, with two labels, code, and type, detailing the status codes of all responses to requests that Vault handles. [GH-30354]
• core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [GH-30576]
• core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [GH-30603]
• events: Add vault_index to an event's metadata if the metadata contains modified=true, to support client consistency controls when reading from Vault in response to an event where storage was modified. [GH-30725]
• physical/postgres: Adds support to authenticate with the PostgreSQL Backend server with cloud based identities (AWS IAM, Azure MSI and GCP IA...

v1.19.5

1.19.5

May 30, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

CHANGES:

• database/snowflake: Update plugin to v0.13.1 [GH-30775]

IMPROVEMENTS:

• plugins: Support registration of CE plugins with extracted artifact directory. [GH-30673]

BUG FIXES:

• ui: Fix broken link to Hashicorp Vault developer site in the Web REPL help. [GH-30670]

v1.19.4

1.19.4

May 16, 2025

CHANGES:

• Update vault-plugin-auth-cf to v0.20.1 [GH-30586]
• auth/azure: Update plugin to v0.20.4 [GH-30543]
• core: Bump Go version to 1.24.3.

IMPROVEMENTS:

• Namespaces (enterprise): allow a root token to relock a namespace
• core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
• core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [GH-30576]
• core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [GH-30603]
• ui: Replaces all instances of the deprecated event.keyCode with event.key [GH-30493]

BUG FIXES:

• core (enterprise): fix a bug where plugin automated root rotations would stop after seal/unseal operations
• plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
  when it becomes active because standby nodes don't extract the artifact when the plugin
  is registered. Remove extracting from Vault and require the operator to place
  the extracted artifact in the plugin directory before registration.

v1.19.3

1.19.3

April 30, 2025

CHANGES:

• auth/jwt: Update plugin to v0.23.2 [GH-30434]

BUG FIXES:

• core (enterprise): fix issue with errors being swallowed on failed HSM logins.
• database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [GH-30320]
• database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [GH-30327]
• identity: Fix non-deterministic merge behavior when two entities have conflicting local aliases. [GH-30390]
• plugins: plugin registration should honor the plugin_tmpdir config [GH-29978]
• secrets/aws: fix a case where GovCloud wasn't taken into account; fix a case where the region setting wasn't respected [GH-30312]

v1.19.2

1.19.2

April 18, 2025

CHANGES:

• core: Bump Go version to 1.23.7
• core: Bump Go version to 1.23.8
• secrets/openldap: Update plugin to v0.15.4 [GH-30279]

BUG FIXES:

• secrets/openldap: Prevent static role rotation on upgrade when NextVaultRotation is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value. Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]
• secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
• secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain intermediate certificates. [GH-30034]
• secrets/transit: fix a panic when rotating on a managed key returns an error [GH-30214]

v1.19.1

1.19.1

April 4, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

CHANGES:

• UI: remove outdated and unneeded js string extensions [GH-29834]
• auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
• auth/azure: Update plugin to v0.20.3 [GH-30082]
• auth/gcp: Update plugin to v0.20.2 [GH-30081]
• core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [GH-29774]
• secrets/azure: Update plugin to v0.21.2 [GH-30037]
• secrets/azure: Update plugin to v0.21.3 [GH-30083]
• secrets/gcp: Update plugin to v0.21.2 [GH-29970]
• secrets/gcp: Update plugin to v0.21.3 [GH-30080]
• secrets/openldap: Update plugin to v0.15.2 [GH-30079]

IMPROVEMENTS:

• activity: mount_type was added to the API response of sys/internal/counters/activity [GH-30071]
• activity: mount_type was added to the API response of sys/internal/counters/activity
• core (enterprise): report errors from the underlying seal when getting entropy.
• storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [GH-29976]

BUG FIXES:

• auth/aws: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [GH-29922]
• auth/ldap: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set [GH-29996]
• core (enterprise): add nil check before attempting to use Rotation Manager operations.
• core: Fix a bug that prevents certain loggers from writing to a log file. [GH-29917]
• identity: reintroduce RPC functionality for group creates, allowing performance standbys to handle external group changes during login and token renewal [GH-30069]
• plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
• secrets/aws: fix a bug where environment and shared credential providers were overriding the WIF configuration [GH-29982]
• secrets/aws: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• secrets/db: fix a panic when a performance standby node attempts to write/update config. [GH-30039]
• secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store. [GH-29852]

v1.19.0

1.19.0

March 5, 2025

Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.

SECURITY:

• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0

CHANGES:

• agent/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29517]
• api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the removedcode query parameter. [GH-28991]
• api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the haunhealthycode query parameter. [GH-28991]
• auth/alicloud: Update plugin to v0.20.0 [GH-29613]
• auth/azure: Update plugin to v0.19.1 [GH-28712]
• auth/azure: Update plugin to v0.19.2 [GH-28848]
• auth/azure: Update plugin to v0.20.0 [GH-29606]
• auth/azure: Update plugin to v0.20.1 [GH-29728]
• auth/cf: Update plugin to v0.19.1 [GH-29295]
• auth/cf: Update plugin to v0.20.0 [GH-29528]
• auth/gcp: Update plugin to v0.20.0 [GH-29591]
• auth/gcp: Update plugin to v0.20.1 [GH-29736]
• auth/jwt: Update plugin to v0.23.0 [GH-29553]
• auth/kerberos: Update plugin to v0.14.0 [GH-29617]
• auth/kubernetes: Update plugin to v0.21.0 [GH-29619]
• auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. [GH-29302]
• auth/ldap: No longer return authentication warnings to client. [GH-29134]
• auth/oci: Update plugin to v0.18.0 [GH-29620]
• core (enterprise): Add tracking of performance standbys by their HA node ID so that RPC connections can be more easily cleaned up when nodes are removed. [GH-29303]
• core/ha (enterprise): Failed attempts to become a performance standby node are now using an exponential backoff instead of a
  10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
  the maximum of 16s. This should make unsealing of the node faster in some cases.
• core/raft: Return an error on sys/storage/raft/join if a node that has been removed from raft cluster attempts to re-join when it still has existing raft data on disk. [GH-29090]
• core: Bump Go version to 1.23.6.
• database/couchbase: Update plugin to v0.13.0 [GH-29543]
• database/elasticsearch: Update plugin to v0.17.0 [GH-29542]
• database/mongodbatlas: Update plugin to v0.14.0 [GH-29584]
• database/redis-elasticache: Update plugin to v0.6.0 [GH-29594]
• database/redis: Update plugin to v0.5.0 [GH-29597]
• database/snowflake: Update plugin to v0.13.0 [GH-29554]
• kmip (enterprise): RSA key generation now enforces key sizes of 2048 or higher
• login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [GH-28807]
• proxy/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29517]
• raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
• sdk: Upgrade to go-secure-stdlib/[email protected], which also bumps github.com/docker/docker to v27.2.1+incompatible [GH-28456]
• secrets/ad: Update plugin to v0.20.1 [GH-29648]
• secrets/alicloud: Update plugin to v0.19.0 [GH-29512]
• secrets/aws: The AWS Secrets engine now persists entries to storage between writes. This enables users
  to not have to pass every required field on each write and to make individual updates as necessary.
  Note: in order to zero out a value that is previously configured, users must now explicitly set the
  field to its zero value on an update. [GH-29497]
• secrets/azure: Update plugin to v0.20.1 [GH-28699]
• secrets/azure: Update plugin to v0.21.0 [GH-29639]
• secrets/azure: Update plugin to v0.21.1 [GH-29729]
• secrets/gcp: Update plugin to v0.21.0 [GH-29598]
• secrets/gcp: Update plugin to v0.21.1 [GH-29747]
• secrets/gcpkms: Update plugin to v0.20.0 [GH-29612]
• secrets/kubernetes: Update plugin to v0.10.0 [GH-29592]
• secrets/kv: Update plugin to v0.21.0 [GH-29614]
• secrets/mongodbatlas: Update plugin to v0.14.0 [GH-29583]
• secrets/openldap: Update plugin to v0.14.1 [GH-28479]
• secrets/openldap: Update plugin to v0.14.2 [GH-28704]
• secrets/openldap: Update plugin to v0.14.3 [GH-28780]
• secrets/openldap: Update plugin to v0.14.5 [GH-29551]
• secrets/openldap: Update plugin to v0.15.0 [GH-29605]
• secrets/openldap: Update plugin to v0.15.1 [GH-29727]
• secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see PKI considerations [GH-29045]
• secrets/terraform: Update plugin to v0.11.0 [GH-29541]
• server/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29228]
• storage/raft: Do not allow nodes that have been removed from the raft cluster configuration to respond to requests. Shutdown and seal raft nodes when they are removed. [GH-28875]
• ui: Partially reverts #20431 and removes ability to download unencrypted kv v2 secret data [GH-29290]
• ui: Upgrade Ember data to v5.3.2 (and minor upgrade of ember-cli, ember-source to v5.8.0) [GH-28798]

FEATURES:

• AWS Secrets Cross-Account Management Support (enterprise): Add support for cross-account management of static roles in AWS secrets engine.
• Automated Root Rotation: A schedule or ttl can be defined for automated rotation of the root credential. [GH-29535]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the AWS Auth and AWS Secrets
  plugins. This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29497]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the DB Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29557]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Auth plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29591]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via t...

v1.18.5

[VAULT-34253] This is an automated pull request to build all artifact…

v1.19.0-rc1

1.19.0-rc1

February 21, 2025

SECURITY:

• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
• raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0

CHANGES:

• api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the removedcode query parameter. [GH-28991]
• api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the haunhealthycode query parameter. [GH-28991]
• auth/alicloud: Update plugin to v0.20.0 [GH-29613]
• auth/azure: Update plugin to v0.19.1 [GH-28712]
• auth/azure: Update plugin to v0.19.2 [GH-28848]
• auth/azure: Update plugin to v0.20.0 [GH-29606]
• auth/cf: Update plugin to v0.19.1 [GH-29295]
• auth/cf: Update plugin to v0.20.0 [GH-29528]
• auth/gcp: Update plugin to v0.20.0 [GH-29591]
• auth/jwt: Update plugin to v0.23.0 [GH-29553]
• auth/kerberos: Update plugin to v0.14.0 [GH-29617]
• auth/kubernetes: Update plugin to v0.21.0 [GH-29619]
• auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. [GH-29302]
• auth/ldap: No longer return authentication warnings to client. [GH-29134]
• auth/oci: Update plugin to v0.18.0 [GH-29620]
• core (enterprise): Add tracking of performance standbys by their HA node ID so that RPC connections can be more easily cleaned up when nodes are removed. [GH-29303]
• core/raft: Return an error on sys/storage/raft/join if a node that has been removed from raft cluster attempts to re-join when it still has existing raft data on disk. [GH-29090]
• database/couchbase: Update plugin to v0.13.0 [GH-29543]
• database/elasticsearch: Update plugin to v0.17.0 [GH-29542]
• database/mongodbatlas: Update plugin to v0.14.0 [GH-29584]
• database/redis-elasticache: Update plugin to v0.6.0 [GH-29594]
• database/redis: Update plugin to v0.5.0 [GH-29597]
• database/snowflake: Update plugin to v0.13.0 [GH-29554]
• kmip (enterprise): RSA key generation now enforces key sizes of 2048 or higher
• login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [GH-28807]
• raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
• sdk: Upgrade to go-secure-stdlib/[email protected], which also bumps github.com/docker/docker to v27.2.1+incompatible [GH-28456]
• secrets/ad: Update plugin to v0.20.1 [GH-29648]
• secrets/alicloud: Update plugin to v0.19.0 [GH-29512]
• secrets/aws: The AWS Secrets engine now persists entries to storage between writes. This enables users
  to not have to pass every required field on each write and to make individual updates as necessary.
  Note: in order to zero out a value that is previously configured, users must now explicitly set the
  field to its zero value on an update. [GH-29497]
• secrets/azure: Update plugin to v0.20.1 [GH-28699]
• secrets/azure: Update plugin to v0.21.0 [GH-29639]
• secrets/gcp: Update plugin to v0.21.0 [GH-29598]
• secrets/gcpkms: Update plugin to v0.20.0 [GH-29612]
• secrets/kubernetes: Update plugin to v0.10.0 [GH-29592]
• secrets/kv: Update plugin to v0.21.0 [GH-29614]
• secrets/mongodbatlas: Update plugin to v0.14.0 [GH-29583]
• secrets/openldap: Update plugin to v0.14.1 [GH-28479]
• secrets/openldap: Update plugin to v0.14.2 [GH-28704]
• secrets/openldap: Update plugin to v0.14.3 [GH-28780]
• secrets/openldap: Update plugin to v0.14.5 [GH-29551]
• secrets/openldap: Update plugin to v0.15.0 [GH-29605]
• secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see PKI considerations [GH-29045]
• secrets/terraform: Update plugin to v0.11.0 [GH-29541]
• server/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [GH-29228]
• storage/raft: Do not allow nodes that have been removed from the raft cluster configuration to respond to requests. Shutdown and seal raft nodes when they are removed. [GH-28875]
• ui: Partially reverts #20431 and removes ability to download unencrypted kv v2 secret data [GH-29290]
• ui: Upgrade Ember data to v5.3.2 (and minor upgrade of ember-cli, ember-source to v5.8.0) [GH-28798]

FEATURES:

• AWS Secrets Cross-Account Management Support (enterprise): Add support for cross-account management of static roles in AWS secrets engine.
• Automated Root Rotation: A schedule or ttl can be defined for automated rotation of the root credential. [GH-29535]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the AWS Auth and AWS Secrets
  plugins. This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29497]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the DB Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29557]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Auth plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29591]
• Automated Root Rotation: Adds Automated Root Rotation capabilities to the GCP Secrets plugin.
  This allows plugin users to automate their root credential rotations based on configurable
  schedules/periods via the Rotation Manager. Note: Enterprise only. [GH-29598]
• Identity De-duplication: Vault can now automatically resolve duplicate
  Entities and Groups by renaming them. This feature is disabled by default and
  can be enabled through the force_identity_deduplication activation flag. [GH-29356]
• Plugins: Allow Enterprise plugins to run externally on Vault Enterprise only.
• Product Usage Reporting: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault feature usage, and adds it to the existing utilization reports. [GH-28858]
• Rotation Manager: Add Rotation Manager to Vault Enterprise Core. The Rotation Manager enables
  plugin users to automate their root credential rotations based on configurable schedules/periods.
• Skip auto import rotation of static roles (enterprise): The Database secrets engine now allows skipping the automatic rotation of static roles during import.
• Transit Ed25519ph and Ed25519ctx support (Enterprise): Support for signing and verifying Ed25519ph and Ed25519ctx signatures types.

IMPROVEMENTS:

• CLI: adds an optional flag (--fail-if-not-fulfilled) to the renew command, which lets the renew command fail on unfulfillable reque...