Bump github.com/hashicorp/vault/api from 1.0.4 to 1.22.0

[dependabot]

Bumps github.com/hashicorp/vault/api from 1.0.4 to 1.22.0.

Release notes

Sourced from github.com/hashicorp/vault/api's releases.

v1.21.1

1.21.1

November 20, 2025

SECURITY:

• auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
• ui: disable scarf analytics for ui builds

CHANGES:

• auth/kubernetes: Update plugin to v0.23.1
• auth/saml: Update plugin to v0.7.0
• auth/saml: Update plugin to v0.7.1, which adds the environment variable VAULT_SAML_DENY_INTERNAL_URLS to allow prevention of idp_metadata_url, idp_sso_url, or acs_urls fields from containing URLs that resolve to internal IP addresses
• core: Bump Go version to 1.25.4
• secrets/azure: Update plugin to v0.25.0+ent
• secrets/pki: sign-verbatim endpoints no longer ignore basic constraints extension in CSRs, using them in generated certificates if isCA=false or returning an error if isCA=true

IMPROVEMENTS:

• Update github.com/dvsekhvalnov/jose2go to fix security vulnerability CVE-2025-63811.
• api: Added sudo-permissioned sys/reporting/scan endpoint which will output a set of files containing information about Vault state to the location specified by the reporting_scan_directory config item.
• auth/ldap: Require non-empty passwords on login command to prevent unauthenticated access to Vault.
• core/metrics: Reading and listing from a snapshot are now tracked via the vault.route.read-snapshot.{mount_point} and vault.route.list-snapshot.{mount_point} metrics.
• license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
• policies: add warning about list comparison when using allowed_parameters or denied_parameters
• secret-sync: add parallelization support to sync and unsync operations for secret-key granularity associations
• secrets/pki: Include the certificate's AuthorityKeyID in response fields for API endpoints that issue, sign, or fetch certs.
• sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
• ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
• ui/activity (enterprise): Allow manual querying of client usage if there is a problem retrieving the license start time.
• ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
• ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
• ui/activity: Display total instead of new monthly clients for HCP managed clusters
• ui/pki: Adds support to configure server_flag, client_flag, code_signing_flag, and email_protection_flag parameters for creating/updating a role.

BUG FIXES:

• activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
• auth/approle (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/aws (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/cert (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/github (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/ldap (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/okta (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/radius (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/scep (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth/userpass (enterprise): Role parameter alias_metadata now populates alias custom metadata field instead of alias metadata.
• auth: fixed panic when supplying integer as a lease_id in renewal.
• core/rotation: avoid shifting timezones by ignoring cron.SpecSchedule

... (truncated)

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

1.15.16 Enterprise

October 09, 2024

SECURITY:

• secrets/identity: A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their privileges to Vault's root policy (CVE-2024-9180) HCSEC-2024-21

IMPROVEMENTS:

• core: log at level ERROR rather than INFO when all seals are unhealthy. [GH-28564]

BUG FIXES:

• auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded. [GH-28597]
• auth/token: Fix token TTL calculation so that it uses max_lease_ttl tune value for tokens created via auth/token/create. [GH-28498]

1.15.15 Enterprise

September 25, 2024

SECURITY:

• secrets/ssh: require valid_principals to contain a value or default_user be set by default to guard against potentially insecure configurations. allow_empty_principals can be used for backwards compatibility [HCSEC-2024-20](https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/7025

CHANGES:

• core: Bump Go version to 1.22.7.
• secrets/ssh: Add a flag, allow_empty_principals to allow keys or certs to apply to any user/principal. [GH-28466]

BUG FIXES:

• secret/aws: Fixed potential panic after step-down and the queue has not repopulated. [GH-28330]
• auth/cert: During certificate validation, OCSP requests are debug logged even if Vault's log level is above DEBUG. [GH-28450]
• auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate. [GH-28309]
• auth: Updated error handling for missing login credentials in AppRole and UserPass auth methods to return a 400 error instead of a 500 error. [GH-28441]
• core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. [GH-28230]

1.15.14 Enterprise

August 29, 2024

CHANGES:

• activity (enterprise): filter all fields in client count responses by the request namespace [GH-27790]
• core: Bump Go version to 1.22.6

IMPROVEMENTS:

• activity log: Changes how new client counts in the current month are estimated, in order to return more visibly sensible totals. [GH-27547]
• activity: /sys/internal/counters/activity will now include a warning if the specified usage period contains estimated client counts. [GH-28068]
• cli: vault operator usage will now include a warning if the specified usage period contains estimated client counts. [GH-28068]
• core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation [GH-28062]

... (truncated)

Commits

• 526ac82 Merge remote-tracking branch 'remotes/from/ce/main'
• 8041281 Backport Update vault-plugin-secrets-terraform to v0.13.0 into ce/main (#9814)
• dce7d8a Backport Update vault-plugin-secrets-kubernetes to v0.12.0 into ce/main (#9811)
• 9cae193 Merge remote-tracking branch 'remotes/from/ce/main'
• abde734 UI: Fix MFA validation timing issue (#9774) (#9799)
• da04c45 Merge remote-tracking branch 'remotes/from/ce/main'
• bf32d52 [UI] Ember Data Migration - KV Cleanup (#9623) (#9794)
• 0c3dcbc Backport Update vault-plugin-auth-azure to v0.22.0 into ce/main (#9782)
• 69b8abb Merge remote-tracking branch 'remotes/from/ce/main'
• 8cf2228 Fix auth method config submit following ember data migration (#9755) (#9793)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[0x0013]

This is quite a big jump in vault library versions.. The tests succeed, so it should be fine, but I think it's still preferable to manually test such a big version bump.