Bump github.com/hashicorp/vault/api from 1.20.0 to 1.21.0

[dependabot]

Bumps github.com/hashicorp/vault/api from 1.20.0 to 1.21.0.

Release notes

Sourced from github.com/hashicorp/vault/api's releases.

v1.20.3

No release notes provided.

v1.20.2

August 06, 2025

SECURITY:

• auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [GH-31427,HCSEC-2025-20].

BUG FIXES:

• agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [GH-31392]
• identity/mfa: revert cache entry change from #31217 and document cache entry values [GH-31421]

v1.20.1

No release notes provided.

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

Previous versions

• v1.10.0 - v1.15.16
• v1.0.0 - v1.9.10
• v0.11.6 and earlier

1.20.3

August 28, 2025

FEATURES:

• IBM RACF Static Role Password Phrase Management (Enterprise): Add support for static role password phrase management to the LDAP secrets engine. (hashicorp/vault-plugin-secrets-openldap#184)

SECURITY:

• core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3. (8b3a9ce1)

CHANGES:

• core: Bump Go version to 1.24.6. (ce56e14e)
• http: Add JSON configurable limits to HTTP handling for JSON payloads: max_json_depth, max_json_string_value_length, max_json_object_entry_count, max_json_array_element_count. [GH-31069]
• sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible (8f172169)
• secrets/openldap (enterprise): update plugin to v0.16.1

IMPROVEMENTS:

• auth/ldap: add explicit logging to rotations in ldap [GH-31401]
• core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
• secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields. [GH-31402]
• secrets/transit: add logging on both success and failure of key rotation [GH-31420]
• ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors [GH-30188]

BUG FIXES:

• core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
• core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics. (91e5f443)
• core/seal: When Seal-HA is enabled, make it an error to persist the barrier keyring when not all seals are healthy. This prevents the possibility of failing to unseal when a different subset of seals are healthy than were healthy at last write. (bbe64227)
• raft (enterprise): auto-join will now work in regions that do not support dual-stack (c66baf5e)
• raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter. [GH-31443]
• replication (enterprise): Fix bug where group updates fail when processed on a standby node in a PR secondary cluster.
• secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
• secrets/database/postgresql: Support for multiline statements in the rotation_statements field. [GH-31442]
• ui: Fix DR secondary view from not loading/transitioning. [GH-31478]

1.20.2

August 06, 2025

... (truncated)

Commits

• e40eca1 VAULT-39294: Deprecate recover_snapshot_id query param and use a header inste...
• c9605c7 VAULT-36947: Support force unloading a snapshot (#8740) (#9036)
• 5d632ef [VAULT-38600] Create TOTP Login MFA credential self-enrollment API endpoint (...
• eaf949c VAULT-37633: Database static role recover operations (#8922) (#8982)
• 3c459f7 [VAULT-39267] actions(slack): migrate to v2 action (#8964) (#8990)
• 50af559 VAULT-38796, VAULT-38889 reformat observation schema to version 2 (#9006) (#9...
• a820af0 Backport [VAULT-38600] Fix the name of the CE stub for mfaLoginEnterprisePath...
• 37bd994 VAULT-38463: Fix ldap failure (#8996) (#9001)
• 3edbb13 changelog: fix commit URL in CE generated template (#9010) (#9013)
• bfd2e54 UI: Moving settings/mount-backend-form to secrets/mounts (#8975) (#8998)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)