chore(deps): bump github.com/openbao/openbao/api/v2 from 2.6.0 to 2.7.0

[dependabot]

Bumps github.com/openbao/openbao/api/v2 from 2.6.0 to 2.7.0.

Changelog

Sourced from github.com/openbao/openbao/api/v2's changelog.

2.7.0-beta20260909

September 9, 2026

FEATURES:

• External Keys: The PKI and Transit secret engines can now use KMS plugins to perform cryptographic operations without storing key material in OpenBao. [GH-3956]
  • Configure mappings to HSM or KMS-backed keys via the /sys/external-keys APIs and grant access to select mounts.
  • Use the PKI engine to sign certificates &co with external private keys.
  • Use the Transit engine to sign, verify, encrypt, and decrypt payloads with external key material.
  • Several KMS plugins provide support:
    • Support for PKCS#11-backed keys is included via the kms-pkcs11 plugin available in openbao-plugins.
    • Support for Transit-backed keys is built-in. This is similar in concept to the built-in Transit seal.
    • Like Auto Seal support via KMS plugins, the interface is provider-agnostic: Develop plugins and enable support for additional providers at any time.
• ML-DSA Support in PKI: Introduces support for the ML-DSA (NIST's FIPS 204) signature algorithm for all CA, CSR, and leaf actions. [GH-3903]
  • ML-DSA is a widely standardized post-quantum cryptography (PQC) algorithm resistant to attacks from quantum computers.
  • Note that Go's OCSP implementation does not support ML-DSA so will be unusable with ML-DSA typed issuers.
• ML-DSA Support in Transit: Introduces support for the ML-DSA (NIST's FIPS 204) signature algorithm. [GH-3909]
  • Generate, import, and export keys of type mldsa-44, mldsa-65 and mldsa-87.
  • Create and verify pure ML-DSA signatures.
• Enable Pure-PQC TLS: TLS connections can now use pure post-quantum key exchanges and certificates. [GH-3769]
  • Operators can specify tls_key_exchange_preferences in server, agent, and proxy listeners to enforce PQC key exchange algorithms (SecP256r1MLKEM768, SecP384r1MLKEM1024, X25519MLKEM768, and MLKEM1024).
  • Operators can use ML-DSA certificates via these listeners as well.
  • Outbound TLS connections from OpenBao can now connect to servers with the above key exchange algorithms or presenting a ML-DSA server or CA certificate.
• PostgreSQL Horizontal Scalability: Enable read scalability on the PostgreSQL storage backend similar to existing Raft support. [GH-3904]
  • Requires ha_enabled = true to be set and cluster_addr to be reachable (establishing a forwarding RPC connection) from standby nodes to the primary.
  • In the event of extended leadership loss, standby nodes will come up as read-enabled.
  • Only works with PostgreSQL physical replication; will not work with logical replication.
• Strong Consistency Control: Support X-Vault-Index and X-Vault-Inconsistent headers to ensure client/server consistency. [GH-3839]
  • X-Vault-Index is now sent when a write is performed.
  • The X-Vault-Inconsistent request header can take the following values to control the fallback behavior when the node is out of date:
    • fail, to respond with 429 Too Many Requests and a Retry-After value,
    • forward-active-node to forward the request to the active node, or
    • await-state to hold the request locally to attempt to catch up, optionally falling back to one of the above behaviors (if also specified) or the server default.
  • On listeners, three new configuration parameters are now respected:
    • consistency_fallback_behavior to set the default fallback for await-state,
    • consistency_missing_header_forward to automatically forward requests which do not have any consistency control headers, and
    • consistency_max_index_wait to indicate the maximum amount of time await-state should pause before forwarding the request.
• PebbleDB Storage Backend: This storage backend is a non-HA, durable backend using PebbleDB for transactions and improved performance. [GH-3879]
• Control Groups: Add support for a new ACL policy stanza, control_group, which specifies when a second party must approve a request for a path. [GH-3436]

IMPROVEMENTS:

• command/server: Add tls_auto_reload configuration option to automatically reload TLS certificate and key files when their contents change, without requiring SIGHUP. [GH-3530]
• command/server: Include disable_standby_reads, allow_unauthenticated_workflows, and unsafe_relative_paths in sanitized config output. [GH-3433]
• command/status: Add support for -field argument to bao status. [GH-3750]
• command/token: Add support for -field argument to bao token lookup. [GH-3618]
• command/namespace/seal-status: Add support for -field and -format argument to bao namespace seal-status. [GH-3750]
• core: Add support for revoke-self with wrapping tokens. [GH-3688]
• core: Switch to cipher.NewGCMWithRandomNonce for fewer nonce generation calls. [GH-3290]
• core/seal: Add configuration options to disable Auto Seal health checks and customize health check intervals and timeout. [GH-3653]

... (truncated)

Commits

• a510a86 Add MLKEM1024 to TLS documentation (#3960)
• 3aad2b3 Make semgrep timer rule happy (#3952)
• 2f99d44 Add changelog entry for External Keys (#3956)
• a730d3d Retroactively add changelog for #2383 (#3959)
• c2fb6b4 Support index headers for consistency in server, api (#3839)
• 1859768 Bump to Go 1.27.1, x/crypto to 0.56.0, go-kms-wrapping (#3955)
• 2401fc9 Fix OIDC key rotation/expiration on standby nodes (#3949)
• 19ed150 Drop github.com/coreos/go-systemd (#3950)
• 84aaf58 Fix TCP listener on OpenBSD (#3951)
• 1d9ba97 Fix errors in snapshot restore command (#3939)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: cd2471c9-376b-4786-958f-50da4ee756a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}