Release v2.4.3

[cipherboy]

SECURITY

• audit: redact HTTPRawBody response parameter in audit logs; CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
• audit: redact []byte type response parameters in audit logs; CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]

IMPROVEMENTS

• core/namespaces: Setting the X-Vault-Namespace Header (or the BAO_NAMESPACE environment variable when using the cli) to "root" now maps to the root namespace. [GH-1918]

BUG FIXES

• core/identity: Entities timestamps are now correctly formatted in RFC3339Nano, as previously done so. [GH-1873]
• core/namespaces: Fix mount creation failing if mount name is equal to the name of the containing namespace [GH-1958]
• core/namespaces: ensure interrupted namespace creation fails gracefully; prevents identity store panic and partial memory-only namespaces [GH-1990]
• core/namespaces: only report namespaces which the provided token has access to from sys/internal/ui/namespaces [GH-1982]
• raft: fix memory leak on standby nodes [GH-1889]
• sdk/framework: Reduce memory usage of repeated mounts through singleton pattern regex cache [GH-1893]
• secrets/kv: KV entries timestamps are now correctly formatted in RFC3339Nano, as previously done so. [GH-1872]

What's Changed

• Fix memory leak in raft (fix memory leak in raft #1889) authored by @phil9909, backported by @phil9909 in Fix memory leak in raft (#1889) #1898
• Switch to singleton pattern regexes (Switch to singleton pattern regexes #1893) authored by @cipherboy, backported by @phil9909 in Switch to singleton pattern regexes (#1893) #1928
• KV engine returns timestamp strings in RFC3339Nano format (KV engine returns timestamp strings in RFC3339Nano format #1872) authored by @wslabosz-reply, backported by @phil9909 in KV engine returns timestamp strings in RFC3339Nano format (#1872) #1926
• Identity subsystem returns timestamp strings in RFC3339Nano format (Identity subsystem returns timestamp strings in RFC3339Nano format #1873) authored by @wslabosz-reply, backported by @phil9909 in Identity subsystem returns timestamp strings in RFC3339Nano format (#1873) #1927
• Remove dependency on bitnami/cassandra container image (Remove dependency on bitnami/cassandra container image #1762) authored by @satoqz, backported by @phil9909 in Remove dependency on bitnami/cassandra container image (#1762) #1930
• Support BAO_NAMESPACE=root (Support BAO_NAMESPACE=root #1918) authored by @phil9909, backported by @cipherboy in Support BAO_NAMESPACE=root (#1918) #1993
• fix: False “existing mount” conflict when mounting a backend at a pa… authored by @dc-tec, backported by @cipherboy in fix: False “existing mount” conflict when mounting a backend at a pa… #1995
• Add check that builds bao with the go on el8 (Add check that builds bao with the go on el8 #1937) authored by @DrDaveD, backported by @cipherboy in Add check that builds bao with the go on el8 (#1937) #1994
• fix(core/namespaces): only return namespaces which the provided token… authored by @pree, backported by @cipherboy in fix(core/namespaces): only return namespaces which the provided token… #1996
• Run make bump-critical for 2.4.2; Go 1.24.9 authored by @cipherboy, backported by @cipherboy in Run make bump-critical for 2.4.2; Go 1.24.9 #1998
• Refactor audit log formatting due to copy (Refactor audit log formatting due to copy #2002) authored by @cipherboy and @wslabosz-reply, backported by @cipherboy in Refactor audit log formatting due to copy (#2002) #2004
• Enable transactional namespace creation (Enable transactional namespace creation #1990) authored by @cipherboy, backported by @cipherboy in Enable transactional namespace creation (#1990) #2003
• Release v2.4.2 authored by @cipherboy in Release v2.4.2 #2005
• Clean go build cache after each Linux architecture authored by @cipherboy in Clean go build cache after each Linux architecture #2010

Full Changelog: v2.4.1...v2.4.3