Bump github.com/hashicorp/consul/api from 1.18.0 to 1.33.4

[dependabot]

Bumps github.com/hashicorp/consul/api from 1.18.0 to 1.33.4.

Release notes

Sourced from github.com/hashicorp/consul/api's releases.

v1.22.5

1.22.5 (February 26, 2026)

SECURITY:

• security: upgrade go version to 1.25.7 [GH-23204]
• dockerfile: the Consul build Go base image to alpine3.23 [GH-23194]
• connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
• security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]
• security: Patched Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods. [GH-23249]
• security: Introduced debounce timing for synchronization operations within federationStateAntiEntropySync. [GH-23196]

IMPROVEMENTS:

• api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [GH-23212]
• agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [GH-23202]
• cli: Added --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration [GH-23109]
• docs: Refreshed the security documentation to include the new HTTP server timeout defaults and relevant configuration options. [GH-23246]
• api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [GH-23157]

v1.22.4

⚠️ Important Notice

We have identified an issue in Consul and Consul Enterprise Feb Patch Release (1.22.4, 1.22.4-ent, 1.21.10-ent, 1.18.20-ent) that requires a corrective patch release.

We recommend that customers avoid using these versions in production environments and wait for the upcoming patch release.

Customers who have upgraded to these versions should temporarily revert to the previous stable release while we prepare a corrected update.

A new patched release is expected by the end of the this month.

Further updates will be shared once the new version is available. We apologize for the inconvenience and appreciate your patience.

1.22.4 (February 18, 2026)

SECURITY:

• security: upgrade go version to 1.25.7 [GH-23204]
• dockerfile: the Consul build Go base image to alpine3.23 [GH-23194]
• connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
• security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]

IMPROVEMENTS:

• api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [GH-23212]
• agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [GH-23202]
• cli: Added --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration [GH-23109]
• api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [GH-23157]

v1.22.3

1.22.3 (January 23, 2026)

... (truncated)

Changelog

Sourced from github.com/hashicorp/consul/api's changelog.

1.22.5 (February 26, 2026)

SECURITY:

• security: upgrade go version to 1.25.7 [GH-23204]
• dockerfile: update the Consul build Go base image to alpine3.23 [GH-23194]
• connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
• security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]
• security: Patched Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods. [GH-23249]
• security: Introduced debounce timing for synchronization operations within federationStateAntiEntropySync. [GH-23196]

IMPROVEMENTS:

• api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [GH-23212]
• agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [GH-23202]
• cli: Added --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration [GH-23109]
• docs: Refreshed the security documentation to include the new HTTP server timeout defaults and relevant configuration options. [GH-23246]
• api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [GH-23157]

1.22.5 Enterprise (February 26, 2026)

SECURITY:

• security: upgrade go version to 1.25.7 [GH-23204]
• dockerfile: the Consul build Go base image to alpine3.23 [GH-23194]
• connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
• security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]
• security: Patched Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods. [GH-23249]
• security: Introduced debounce timing for synchronization operations within federationStateAntiEntropySync. [GH-23196]

IMPROVEMENTS:

• api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [GH-23212]
• agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [GH-23202]
• cli: Added --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration [GH-23109]
• docs: Refreshed the security documentation to include the new HTTP server timeout defaults and relevant configuration options. [GH-23246]
• api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [GH-23157]

1.21.11 Enterprise (February 26, 2026)

SECURITY:

• security: upgrade go version to 1.25.7 [GH-23204]
• dockerfile: the Consul build Go base image to alpine3.23 [GH-23194]
• connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [GH-23109]
• security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [GH-22739]
• security: Patched Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods. [GH-23249]
• security: Introduced debounce timing for synchronization operations within federationStateAntiEntropySync. [GH-23196]

... (truncated)

Commits

• 2a06921 Update submodule dependencies for api release
• 5c7eb1c Backport of increase default HTTP timeouts for blocking queries and long poll...
• 9a42780 Prepare flow fix for 1.22.x (#23264)
• f6d4f4d Backport of Fix for cache context to save cache data in entries on context ca...
• 8f5205a Backport of docs(#22739): update security note with HTTP server timeout defau...
• 53eab0d Backport of bumps: update body-parser to 2.2.1+ into release/1.22.x (#23240)
• a989831 Backport of Fix for arbitrary file reads vulnerabilities into release/1.22.x ...
• 803992d Post release 1.22.x (#23233)
• dd775d8 Backport of migrate to aws-sdk-go-v2 into release/1.22.x (#23225)
• ba05bd5 Backport of manage visibility of admin partition selector into release/1.22.x...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)