Prepare for v5.8.0 Release (#2821)

* Prepare for v5.8.0 Release

* Add missing changelog entry

* Update BOB_ENVIRONMENT

* Update go version to 1.26.1

* fix formatting to be go 1.26-compliant

* Update accpetance test matrix

Author: siyer-corp

.github/workflows/build.yml

@@ -153,12 +153,12 @@ jobs:
       fail-fast: false
       matrix:
         image:
-        - "vault-enterprise:1.16.27-ent"
+        - "vault-enterprise:1.16.31-ent"
         - "vault-enterprise:1.17.18-ent"
         - "vault-enterprise:1.18.15-ent"
-        - "vault-enterprise:1.19.12-ent"
-        - "vault-enterprise:1.20.5-ent"
-        - "vault-enterprise:1.21.1-ent"
+        - "vault-enterprise:1.19.15-ent"
+        - "vault-enterprise:1.20.9-ent"
+        - "vault-enterprise:1.21.4-ent"
         - "vault:latest"
         terraform_version:
         - "latest" # always test against the latest stable, which might be a duplicate matrix member.

.go-version

@@ -1 +1 @@
-1.25.7
+1.26.1

CHANGELOG.md

@@ -1,31 +1,70 @@
 ## Unreleased
 
+## 5.8.0 (March 12, 2026)
+
 FEATURES:
 
 * Add support for CF auth backend: `vault_cf_auth_backend_config` and `vault_cf_auth_backend_role` resources, and `vault_cf_auth_login` ephemeral resource for short-lived Vault tokens.
-* **New Ephemeral Resource**: Add ephemeral resource for `vault_generic_secret` ([#2735](https://github.com/hashicorp/terraform-provider-vault/pull/2735))
 * Add support for SPIFFE secrets backend: ([#2660](https://github.com/hashicorp/terraform-provider-vault/pull/2660))
 * Add support for pki-external-ca secrets backend: ([#2771](https://github.com/hashicorp/terraform-provider-vault/pull/2771))
 * Add new KMIP resources `vault_kmip_secret_ca_generated`, `vault_kmip_secret_ca_imported`, `vault_kmip_secret_listener`, and add support for the `ca` field in `vault_kmip_secret_role`: ([#2773](https://github.com/hashicorp/terraform-provider-vault/pull/2771))
 * `vault_secrets_sync_azure_destination`: Add support for Workload Identity Federation (WIF) fields `identity_token_audience`, `identity_token_audience_wo_version`, `identity_token_ttl`, and `identity_token_key` to enable token-based authentication with Azure. Requires Vault 2.0.0+. ([#2790](https://github.com/hashicorp/terraform-provider-vault/pull/2790))
 * `vault_secrets_sync_aws_destination`: Add support for Workload Identity Federation (WIF) fields `identity_token_audience`, `identity_token_ttl`, and `identity_token_key` to enable token-based authentication with AWS. Requires Vault 2.0.0+. ([#2792](https://github.com/hashicorp/terraform-provider-vault/pull/2792))
 * `vault_secrets_sync_gcp_destination`: Add support for Workload Identity Federation (WIF) fields `identity_token_audience_wo`, `identity_token_audience_wo_version`, `identity_token_ttl`, `identity_token_key_wo`, `identity_token_key_wo_version` and `service_account_email` to enable token-based authentication with GCP. Requires Vault 2.0.0+. ([#2798](https://github.com/hashicorp/terraform-provider-vault/pull/2798))
-
-* **New Ephemeral Resource**:Add ephemeral resource `vault_terraform_token`, by @drewmullen ([#2616](https://github.com/hashicorp/terraform-provider-vault/pull/2616))
+* **New Ephemeral Resource**: Add ephemeral resource for `vault_generic_secret` ([#2735](https://github.com/hashicorp/terraform-provider-vault/pull/2735))
+* **New Ephemeral Resource**: Add ephemeral resource `vault_terraform_token`, by @drewmullen ([#2616](https://github.com/hashicorp/terraform-provider-vault/pull/2616))
 
 IMPROVEMENTS:
 
-* `vault_managed_keys`: Add support for GCP Cloud KMS managed keys with parameters: `credentials`, `project`, `key_ring`, `region`, `crypto_key`, `crypto_key_version`, and `algorithm`. 
+* `vault_managed_keys`: Add support for GCP Cloud KMS managed keys with parameters: `credentials`, `project`, `key_ring`, `region`, `crypto_key`, `crypto_key_version`, and `algorithm`. ([#2769](https://github.com/hashicorp/terraform-provider-vault/pull/2769))
 * `vault_okta_auth_backend`: Add support for write-only field api_token_wo with version counters to prevent sensitive credentials from being stored in Terraform state. Deprecate `organization` and `token` and replace with `org_name` and `api_token` respectively in `vault_okta_auth_backend` resource. ([#2736](https://github.com/hashicorp/terraform-provider-vault/pull/2736))
 * `vault_kubernetes_secret_backend_role`: Add support for `token_default_audiences` field to configure default audiences for generated Kubernetes tokens. Requires Vault 1.15+. ([#2722](https://github.com/hashicorp/terraform-provider-vault/pull/2722))
 * `vault_raft_snapshot_agent_config`: Add support for `azure_auth_mode` and `azure_client_id` fields for Azure Managed Identity authentication (Vault Enterprise 1.18.0+), and `autoload_enabled` field for automatic snapshot restoration (Vault Enterprise 1.21.0+). ([#2758](https://github.com/hashicorp/terraform-provider-vault/pull/2758))
 * `vault_ssh_secret_backend_role`: Add support for fields (`default_extensions_template`, `exclude_cidr_list`, `port`) and improve handling of key-type-specific fields (`default_extensions`, `default_extensions_template`, `exclude_cidr_list`, `port`) to prevent drift. Fields that are not applicable to a role's key type (CA or OTP) are now conditionally set in state only when returned by Vault, preventing perpetual drift when users configure fields that Vault ignores. CA key type supports: `default_extensions`, `default_extensions_template`. OTP key type supports: `port`, `exclude_cidr_list`. ([#2747](https://github.com/hashicorp/terraform-provider-vault/pull/2747))
-* `vault_pki_secret_backend_root_cert`: Add support for `use_pss` and `key_usage` fields to configure PSS signature scheme and X.509 key usage constraints for root CA certificates. Requires Vault 1.18.0+ and 1.19.2+ respectively.([#2754](https://github.com/hashicorp/terraform-provider-vault/pull/2754))
+* Added remove_roots_from_chain field to `vault_pki_secret_backend_root_cert` and `resource_pki_secret_backend_sign`. ([#2760](https://github.com/hashicorp/terraform-provider-vault/pull/2760))
+* `vault_pki_secret_backend_root_cert`: Add support for `use_pss` and `key_usage` fields to configure PSS signature scheme and X.509 key usage constraints for root CA certificates. Requires Vault 1.18.0+ and 1.19.2+ respectively. ([#2754](https://github.com/hashicorp/terraform-provider-vault/pull/2754))
 * `vault_pki_secret_backend_root_sign_intermediate`: Add version check for `key_usage` field to ensure compatibility with Vault 1.19.2+ for configuring X.509 key usage constraints on intermediate CA certificates. ([#2754](https://github.com/hashicorp/terraform-provider-vault/pull/2754))
 * `provider/auth_jwt`: Add support for `distributed_claim_access_token` field in the `auth_login_jwt` configuration block. ([#2782](https://github.com/hashicorp/terraform-provider-vault/pull/2782))
 * `vault_database_secret`: Add support for additional credential types (`rsa_private_key`, `client_certificate`, `private_key`, `private_key_type`) in the ephemeral resource to support all database credential types available in Vault's database secrets engine. ([#2767](https://github.com/hashicorp/terraform-provider-vault/pull/2767))
+* Updated dependencies:
+  * `github.com/Azure/azure-sdk-for-go/sdk/azcore` v1.20.0 -> v1.21.0
+  * `github.com/aws/aws-sdk-go-v2` v1.32.5 -> v1.41.3
+  * `github.com/aws/aws-sdk-go-v2/service/iam` v1.38.1 -> v1.53.5
+  * `github.com/aws/aws-sdk-go-v2/service/sts` v1.33.1 -> v1.41.8
+  * `github.com/aws/smithy-go` v1.22.1 -> v1.24.2
+  * `github.com/coreos/pkg` v0.0.0-20230601102743-20bbbf26f4d8 -> v0.0.0-20240122114842-bbd7aa9bf6fb
+  * `github.com/go-viper/mapstructure/v2` v2.4.0 -> v2.5.0
+  * `github.com/googleapis/enterprise-certificate-proxy` v0.3.12 -> v0.3.14
+  * `github.com/hashicorp/consul/api` v1.33.0 -> v1.33.4
+  * `github.com/hashicorp/go-secure-stdlib/awsutil/v2` v2.1.1 -> v2.1.2
+  * `github.com/hashicorp/terraform-plugin-framework` v1.16.1 -> v1.19.0
+  * `github.com/hashicorp/terraform-plugin-go` v0.29.0 -> v0.31.0
+  * `github.com/hashicorp/terraform-plugin-mux` v0.21.0 -> v0.23.0
+  * `github.com/hashicorp/terraform-plugin-sdk/v2` v2.38.1 -> v2.40.0
+  * `github.com/hashicorp/terraform-plugin-testing` v1.13.3 -> v1.15.0
+  * `github.com/hashicorp/vault-plugin-auth-oci` v0.20.0 -> v0.20.1
+  * `github.com/hashicorp/vault/sdk` v0.22.0 -> v0.23.0
+  * `github.com/spiffe/go-spiffe/v2` v2.5.0 -> v2.6.0
+  * `golang.org/x/crypto` v0.45.0 -> v0.49.0
+  * `golang.org/x/net` v0.47.0 -> v0.52.0
+  * `golang.org/x/oauth2` v0.31.0 -> v0.36.0
+  * `golang.org/x/sync` v0.19.0 -> v0.20.0
+  * `golang.org/x/sys` v0.41.0 -> v0.42.0
+  * `golang.org/x/text` v0.34.0 -> v0.35.0
+  * `golang.org/x/time` v0.14.0 -> v0.15.0
+  * `golang.org/x/tools` v0.41.0 -> v0.42.0
+  * `google.golang.org/api` v0.251.0 -> v0.271.0
+  * `google.golang.org/genproto` v0.0.0-20250603155806-513f23925822 -> v0.0.0-20260311181403-84a4fc48630c
+  * `google.golang.org/genproto/googleapis/api` v0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260226221140-a57be14db171
+  * `google.golang.org/genproto/googleapis/rpc` v0.0.0-20260217215200-42d3e9bedb6d -> v0.0.0-20260226221140-a57be14db171
+  * `google.golang.org/grpc` v1.79.1 -> v1.79.2
+  * `hashicorp/setup-terraform` v3 -> v4
+  * `github.com/cloudflare/circl` v1.6.1 -> v1.6.3
+  * `filippo.io/edwards25519` v1.1.0 -> v1.1.1
+  * `k8s.io/utils` v0.0.0-20240102154912-e7106e64919e -> v0.0.0-20260210185600-b8788abfbbc2
 
 BUGS:
+
 * Clears the bindpass field in the state file after migrating to the write-only field in `vault_ldap_auth_backend` resource. ([#2813](https://github.com/hashicorp/terraform-provider-vault/pull/2813))
 
 ## 5.7.0 (February 5, 2026)

go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform-provider-vault
 
-go 1.25.7
+go 1.26.1
 
 require (
 	cloud.google.com/go/compute/metadata v0.9.0
@@ -10,11 +10,11 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
 	github.com/aws/aws-sdk-go v1.55.8
 	github.com/aws/aws-sdk-go-v2 v1.41.3
-	github.com/aws/aws-sdk-go-v2/service/iam v1.53.4
+	github.com/aws/aws-sdk-go-v2/service/iam v1.53.5
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.8
 	github.com/aws/smithy-go v1.24.2
 	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/coreos/pkg v0.0.0-20230601102743-20bbbf26f4d8
+	github.com/coreos/pkg v0.0.0-20240122114842-bbd7aa9bf6fb
 	github.com/denisenkom/go-mssqldb v0.12.3
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/go-test/deep v1.1.1
@@ -31,13 +31,13 @@ require (
 	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
 	github.com/hashicorp/go-version v1.8.0
-	github.com/hashicorp/terraform-plugin-framework v1.18.0
+	github.com/hashicorp/terraform-plugin-framework v1.19.0
 	github.com/hashicorp/terraform-plugin-framework-validators v0.19.0
-	github.com/hashicorp/terraform-plugin-go v0.30.0
+	github.com/hashicorp/terraform-plugin-go v0.31.0
 	github.com/hashicorp/terraform-plugin-log v0.10.0
-	github.com/hashicorp/terraform-plugin-mux v0.22.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.39.0
-	github.com/hashicorp/terraform-plugin-testing v1.14.0
+	github.com/hashicorp/terraform-plugin-mux v0.23.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.0
+	github.com/hashicorp/terraform-plugin-testing v1.15.0
 	github.com/hashicorp/vault-plugin-auth-jwt v0.25.0
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.16.0
 	github.com/hashicorp/vault-plugin-auth-oci v0.20.1
@@ -49,12 +49,12 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/spiffe/go-spiffe/v2 v2.6.0
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.48.0
-	golang.org/x/net v0.51.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/net v0.52.0
 	golang.org/x/oauth2 v0.36.0
-	google.golang.org/api v0.269.0
-	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
+	google.golang.org/api v0.271.0
+	google.golang.org/genproto v0.0.0-20260311181403-84a4fc48630c
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
 )
 
 require (
@@ -112,7 +112,7 @@ require (
 	github.com/google/certificate-transparency-go v1.3.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.12 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
 	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/gosimple/unidecode v1.0.1 // indirect
 	github.com/hashicorp/cap v0.10.0 // indirect
@@ -207,15 +207,15 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20250808145144-a408d31f581a // indirect
 	golang.org/x/mod v0.33.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.41.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
-	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/grpc v1.79.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect