What's Changed

• fix: upgrade klauspost/compress to v1.18.7 and Go to 1.26.10 by @hariom-hashicorp in #706

Full Changelog: v2.2.5...v2.2.6

Bug fixes

• s3: only force path-style addressing for non-AWS endpoints (fixes FIPS endpoints) (#676)
• sanitize destination path of keys received from S3/GCS List (#693)

Full Changelog: v1.8.9...v1.8.10

Bug Fixes

• sanitize destination path of keys received from S3/GCS List (v2) (#694)

Full Changelog: v2.2.4...v2.2.5

What's Changed

• [v2] update s3 and gcs to use most recent v2 module version by @nywilken in #502
• [v2] Bumps go-getter/v2/cmd/go-getter to use go-getter/gcs/v2 and go-getter/s3/v2 @v2.2.3 by @nywilken in #503
• V2: Replace deprecated ioutil. by @tristanmorgan in #451
• parse checksum even when no EOL is found (#285) by @nickryand in #376
• fix: update syntax to V2 in GitHub Actions by @CreatorHead in #580
• feat(s3): migrate to AWS SDK v2 by @hariom-hashicorp in #663
• fix(decompress): sanitize file permissions after tar/zip extraction (backport of #669) by @hariom-hashicorp in #690
• fix(v2): backport security fix with major version upgrades by @hariom-hashicorp in #691

New Contributors

• @nickryand made their first contribution in #376
• @hariom-hashicorp made their first contribution in #663

Full Changelog: v2.2.3...v2.2.4

1.8.9 (September 3, 2026)

IMPROVEMENTS:

• build: Updated Go to 1.26.8 [GH-657]

1.8.8 (August 12, 2026)

SECURITY:

• git: Remove .git from the destination dir before git init, even if it's a file instead of a directory [GH-634]

IMPROVEMENTS:

• build: Updated Go to 1.26.5 [GH-657]

What's Changed

• [chore] : Bump the go group with 2 updates by @dependabot[bot] in #576
• use %w to wrap error by @Ericwww in #475
• fix: #538 http file download skipped if headResp.ContentLength is 0 by @martijnvdp in #539
• chore: fix error message capitalization in checksum function by @ssagarverma in #578
• [chore] : Bump the go group with 8 updates by @dependabot[bot] in #577
• Fix git url with ambiguous ref by @nimasamii in #382
• fix: resolve compilation errors in get_git_test.go by @CreatorHead in #579
• [chore] : Bump the actions group with 2 updates by @dependabot[bot] in #582
• [chore] : Bump the go group with 3 updates by @dependabot[bot] in #583
• test that arbitrary files cannot be checksummed by @schmichael in #250
• [chore] : Bump google.golang.org/api from 0.260.0 to 0.262.0 in the go group by @dependabot[bot] in #585
• [chore] : Bump actions/checkout from 6.0.1 to 6.0.2 in the actions group by @dependabot[bot] in #586
• [chore] : Bump the go group with 3 updates by @dependabot[bot] in #588
• [chore] : Bump actions/cache from 5.0.2 to 5.0.3 in the actions group by @dependabot[bot] in #589
• [chore] : Bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 in the actions group by @dependabot[bot] in #592
• [chore] : Bump google.golang.org/api from 0.264.0 to 0.265.0 in the go group by @dependabot[bot] in #591
• [chore] : Bump the go group with 5 updates by @dependabot[bot] in #593
• IND-6310 - CRT Onboarding by @nasareeny in #584
• Fix crt build path by @ssagarverma in #594
• [chore] : Bump the go group with 3 updates by @dependabot[bot] in #596
• fix: remove checkout action from set-product-version job by @ssagarverma in #598
• [chore] : Bump the actions group with 4 updates by @dependabot[bot] in #595
• fix(deps): upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (GO-2026-4394) by @ssagarverma in #599
• Prepare go-getter for v1.8.5 release by @nasareeny in #597
• [chore] : Bump the actions group with 2 updates by @dependabot[bot] in #600
• sec: bump go and xrepos + redact aws tokens in url by @dduzgun-security in #604

NOTES:

Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp release site. We will no longer attach release assets to GitHub Releases.

New Contributors

• @Ericwww made their first contribution in #475
• @martijnvdp made their first contribution in #539
• @nimasamii made their first contribution in #382
• @nasareeny made their first contribution in #584

Full Changelog: v1.8.4...v1.8.5

What's Changed

• [IND-4227][COMPLIANCE] chore: Fix lint issues-build tags by @ssagarverma in #568
• [IND-4227] [COMPLIANCE] Update Copyright Headers by @oss-core-libraries-dashboard[bot] in #566
• [COMPLIANCE] Update Copyright Headers by @oss-core-libraries-dashboard[bot] in #571
• [chore] : Bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #567
• fix: allow downloading S3 files from MinIO over http by @vsarunas in #570
• [chore] : Bump the actions group across 1 directory with 6 updates by @dependabot[bot] in #574
• [chore] : Bump the go group across 1 directory with 12 updates by @dependabot[bot] in #575

New Contributors

• @ssagarverma made their first contribution in #568
• @oss-core-libraries-dashboard[bot] made their first contribution in #566

Full Changelog: v1.8.3...v1.8.4

What's Changed

• [chore] : Bump actions/cache from 4.2.4 to 4.3.0 in the actions group by @dependabot[bot] in #562
• [chore] : Bump aws-actions/configure-aws-credentials from 5.0.0 to 5.1.0 in the actions group by @dependabot[bot] in #563
• Remove failed decompressed files by @allisonlarson in #564

New Contributors

• @allisonlarson made their first contribution in #564

Full Changelog: v1.8.2...v1.8.3