Bump github.com/hashicorp/vault/sdk from 0.25.0 to 0.25.1

[dependabot]

Bumps github.com/hashicorp/vault/sdk from 0.25.0 to 0.25.1.

Changelog

Sourced from github.com/hashicorp/vault/sdk's changelog.

Previous versions

• v1.10.0 - v1.15.16
• v1.0.0 - v1.9.10
• v0.11.6 and earlier

2.0.4

August 04, 2026

BREAKING CHANGES:

• containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.

SECURITY:

• acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.
• identity/scim (enterprise): The identity/entity/merge endpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM boundaries.
• identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.
• identity: entity/name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity

CHANGES:

• auth/oci: Update plugin to v0.21.3
• core: Bump Go version to 1.26.5.
• core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.

FEATURES:

• secrets: Added ability to view secrets in YAML format

IMPROVEMENTS:

• auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
• core (enterprise): Add an endpoint at sys/config/oauth-resource-server/id/:config_id to read oauth resource server profiles by config_id
• core (enterprise): Make OAuth resource server JWT typ validation more permissive for tokens from IdPs such as Okta by allowing a missing typ header, while restricting present typ values to at+jwt, application/at+jwt, and JWT.
• core (entreprise): Ameriolate sealwrap lock contention for core paths.
• core/acl: Adds a global deny_slash_in_templated_path configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to false.
• core/identity: Adds a global deny_slash_in_templated_path configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to false.
• managed-keys/PKCS#11
• managed-keys/PKCS#11
• events: Add VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.
• identity/scim (enterprise): Added filtering support to the GET /scim/v2/Users and GET /scim/v2/Groups endpoints per RFC 7644. Supported filters: userName eq, externalId eq, active eq, and meta.lastModified gt/ge/lt/le for Users; displayName eq and meta.lastModified gt/ge/lt/le for Groups. Unsupported filter expressions return HTTP 400. ServiceProviderConfig now advertises filter.supported: true.
• identity/scim (enterprise): Improve SCIM User and Group listing endpoint performance by using prefix sort instead of a separate sort pass.
• identity: Include entity status and entity/alias timestamp details in entity list key_info responses.
• oauth-resource-server: Add support for fine-grained policy control options (parameter constraints) in Rich Authorization Requests (RAR), including allowed_parameters, denied_parameters, and required_parameters inside authorization_details.
• oauth-resource-server: Add support for identity template expressions (e.g. {{identity.entity.id}}) in Rich Authorization Requests (RAR).
• scim: User resources now include a read-only groups field listing the direct group memberships managed by the requesting SCIM client, per RFC 7643.
• secrets/kv (enterprise): Support reading and recovering KVv2 secrets from a loaded snapshot, including in-place recover and copy-from-path within the same mount and namespace.

... (truncated)

Commits

• 58d7286 Backport [VAULT-43813] go: resolve CVE-2026-34986 and GHSA-78h2-9frx-2jm8 by ...
• 1017b01 pipeline(backport): don't ignore space changes (#13660) (#13671)
• 695eb52 Backport core: upgrade to secrets-store-sync to v0.8.1 in main into ce/main
• 352c6ca Remove extra margin (#13639) (#13648)
• 76241c1 VAULT-43166: Redirect to a cleaned path (#12786) (#13524)
• 608db8c Fix pkixternalca feature bugs in Vault Agent (#13613) (#13622)
• 58009c3 Add ldaputil ValidateSelfManaged and test coverage (#13593) (#13616)
• 39b907a Update CHANGELOG.md (#13610) (#13614)
• fd76450 go: use github.com/cloudflare/circl@v1.6.3 (#13598)
• 9fec846 bump version to 3.0.0-beta1 (#13580) (#13582)
• Additional commits viewable in compare view

[mendsley]

@dependabot rebase