---
layout: docs
page_title: v0.19.0 release notes
description: >-
  Learn more about the new features included in the Boundary 0.19.0 release. Understand any deprecations, changes, and known issues.
---

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
> [!IMPORTANT]  
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️

# Boundary 0.19.0 release notes

**GA date:** February 10, 2025

@include 'release-notes/intro.mdx'

## Important changes

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Change</th>
      <th style={{verticalAlign: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Role creation
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    Docker image no longer contains <code>curl</code>
    </td>
    <td style={{verticalAlign: 'middle'}}>
    As of version 0.17.1 and later, the <code>curl</code> binary is no longer included in the published Docker container image for Boundary. The image now includes <code>wget</code>, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having <code>curl</code> in the image, you can dynamically install it using <code>apk</code>.
    <br /><br />
    Learn more:&nbsp; <a href="#known-issues-and-breaking-changes">Known issues and breaking changes </a>
    </td>
  </tr>

<tr>
    <td style={{verticalAlign: 'middle'}}>
    Go version 1.23 TLS handshake behavior changes
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x and later controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior.
    <br /><br />
    Learn more:&nbsp; <a href="#known-issues-and-breaking-changes">Known issues and breaking changes </a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    Error when sending requests to aliases using HCP Boundary
    </td>
    <td style={{verticalAlign: 'middle'}}>
    A known issue that was caused by the way default grants were previously configured in HCP Boundary could cause you to receive 500 errors when you attempted to list resolvable aliases. The issue has been resolved. Any clusters that you created on or after April 26, 2025 should not have the issue.
    <br /><br />
    You can add grants to resolve the error for any older clusters that exhibit this behavior.
    <br /><br />
    Learn more:&nbsp; <a href="#hcp-grants">Known issues and breaking changes </a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    Boundary client version number realignment
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Previously, the Boundary Client Agent and installer used a numbering scheme that was inconsistent with Boundary's release numbers. This inconsistency could make it difficult to understand version support and compatibility.
    <br /><br />
    On May 27, 2025 new versions of the Boundary Client Agent and installer were released with a new numbering scheme that more closely follows Boundary's release numbers. Those versions were released as 0.19.5 to match the major Boundary version 0.19.x. Going forward, the Client Agent and installer will use the same major number as the current Boundary release. Any patches or updates will be reflected in the minor number.
    <br /><br />
    Learn more about control plane and client compatibility:&nbsp; <a href="/boundary/docs/enterprise/supported-versions">Boundary Enterprise supported versions policy </a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    Redundant grant scopes are no longer permitted
    </td>
    <td style={{verticalAlign: 'middle'}}>
    You may have redundant grant scopes if you applied a grant to a scope and the scope also inherited the grant from the <code>this</code>, <code>children</code>, or <code>descendants</code> options. As of Boundary version 0.19.3, redundant grant scopes are no longer permitted.
    <br /><br />
    When you upgrade a Boundary Enterprise or Community edition cluster to version 0.19.3 or later, the migration will fail with a message if the database contains any redundant grant scopes. The migration tool provides a command that automatically removes any redundant grant scopes so that you can proceed with the upgrade.
    <br /><br />
    For HCP Boundary users, the redundant grant scopes are automatically removed as part of the migration process.
    <br /><br />
    Learn more about removing redundant grant scopes and upgrading to version 0.19.3 or later:&nbsp; <a href="#redundant-grants">Known issues and breaking changes </a>
    </td>
  </tr>

  </tbody>
</table>

## New features

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Feature</th>
      <th style={{verticalAlign: 'middle'}}>Update</th>
      <th style={{verticalAlign: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Dynamic host catalogs for GCP
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary now supports dynamic host catalogs for GCP.
    <br /><br />
    When you configure dynamic host catalogs, Boundary securely queries infrastructure providers at runtime to discover and configure new services. You can define rules for whether you want Boundary to automatically add any discovered hosts as members of the host set.
    <br /><br />
    Learn more:&nbsp;<a href="/boundary/docs/hosts">Host discovery</a> and <a href="/boundary/docs/hosts/gcp">GCP dynamic hosts</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Worker filter generator
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
    A new filter generator was added to the Admin Console UI, allowing you to more easily create worker filters for targets, credential stores, and storage buckets.
    <br /><br />
    Learn more:&nbsp;<a href="/boundary/docs/workers/worker-tags">Worker tags</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Vault brokered credentials format change
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Previously, when you brokered credentials from a Vault credential store, the credentials displayed in raw JSON and could contain special characters. It was difficult to consume the credentials in this format. Credentials are now displayed in a format that is easier to cut and paste.
    <br /><br />
    Learn more:&nbsp;<a href="/boundary/docs/configuration/credential-management/static-cred-vault">Create a Vault credential store</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Azure Virtual Machine Scale Set support for dynamic host catalogs
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA in version 0.19.1
    </td>
    <td style={{verticalAlign: 'middle'}}>
    The Azure plugin now supports Azure Virtual Machine Scale Sets in both Flexible and Uniform orchestration modes for dynamic host catalogs. It automatically discovers any individual virtual machine instances that are part of the scale sets and adds them as hosts.
    <br /><br />
    Learn more:&nbsp;<a href="/boundary/docs/hosts/azure">Azure dynamic host catalogs</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Transparent sessions
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA in version 0.19.2
    </td>
    <td style={{verticalAlign: 'middle'}}>
    The transparent sessions feature is now generally available to HCP Boundary and Boundary Enterprise users.
    <br /><br />
    Transparent sessions allows users to eliminate steps in their current workflows using Boundary’s Client Agent, a component that operates in the background to intercept network traffic and automatically route this traffic through a session if the user is authenticated and authorized.
    <br /><br />
    Platform teams and access management teams that administer Boundary can now build much faster, simpler secure remote access workflows that feel more intuitive and invisible to their developer customers.
    <br /><br />
    Learn more:&nbsp;<a href="/boundary/docs/concepts/transparent-sessions">Transparent sessions</a> and <a href="/boundary/docs/api-clients/client-agent">Client Agent</a>.
    </td>
  </tr>

  </tbody>
</table>

## Known issues and breaking changes

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Version</th>
      <th style={{verticalAlign: 'middle'}}>Issue</th>
      <th style={{verticalAligh: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.13.0+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Rotation of AWS access and secret keys during a session results in stale recordings
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials.
    <br /><br />
    As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials.
    Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back.
    </td>
  </tr>
  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.13.0+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Unsupported recovery workflow during worker failure
    </td>
    <td style={{verticalAlign: 'middle'}}>
    If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example.
    <br /><br />
    Learn more:&nbsp;
    <a href="/boundary/docs/troubleshoot/troubleshoot-recorded-sessions#unsupported-recovery-workflow">Unsupported recovery workflow</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.1+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Docker image no longer contains <code>curl</code>
    </td>
    <td style={{verticalAlign: 'middle'}}>
    As of version 0.17.1 and later, the <code>curl</code> binary is no longer included in the published Docker container image for Boundary.
    <br /><br />
    The image now includes <code>wget</code>. You can use <code>wget</code> to check the health endpoint for workers.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/operations/health#check-the-health-endpoint-using-wget">Check the health endpoint using <code>wget</code></a>
    <br /><br />
    If your workflow depends on having <code>curl</code> in the image, you can dynamically install it using <code>apk</code>. Refer to the following commands for examples of using <code>apk</code> to install <code>curl</code>:
    <br /><br />
    <code>&lt;CONTAINER-ID&gt; apk add curl</code>
    <br /><br />
    or
    <br /><br />
    <code>kubectl exec -ti &lt;NAME&gt; -- apk add curl</code>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.18.x+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary version 0.18.x and later CLI is unable to establish connections using the <code>boundary connect</code> command
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x and later controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior.
    <br /><br />
    To revert back to the previous TLS handshake behavior, add the <code>tlskyber=0</code> parameters to the GODEBUG environment variable before the <code>boundary connect</code> command. For example:
    <br /><br />
    <code>GODEBUG=tlskyber=0 boundary connect ssh -target-id &lt;ID&gt;</code>
    <br /><br />
    Learn more: <a href="https://github.com/golang/go/issues/70047">Go issue #70047</a> and <a href="https://tip.golang.org/doc/go1.23">Go 1.23 Release Notes</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.19.0
    <br /><br />
    (Fixed in 0.19.1)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Soft-deleted users are not properly authenticated
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Version 0.19.0 introduced a soft delete for when a cached user's auth tokens are deleted, but there is a valid refresh token that is less than 20 days old. Boundary considers those users as deleted. But it keeps their user information in the cache so that it can restore the information, if they log in again.
    <br /><br />
    However, soft-deleted users were not being properly restored when they logged back in and it affected search capabilities.
    <br/><br />
    This issue is resolved in version 0.19.1. Soft-deleted users are now properly restored as active when they log in again if the refresh token is less than 20 days old.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0 - 0.19.0
    <br /><br />
    (Fixed in 0.19.2)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Canceled SSH connections cause performance issues
    </td>
    <td style={{verticalAlign: 'middle'}}>
    When an SSH connection was canceled, it could cause a spike in CPU usage. In some cases, egress workers become unresponsive, leading to performance issues. The issue occurred when the connection context was canceled at specific times in the process, creating a busy loop that prevented workers from completing tasks.
    <br/><br />
    This issue is resolved in version 0.19.2. Workers no longer enter a busy loop when SSH connections are canceled.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.19.0
    <br /><br />
    (Fixed in 0.19.2)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Unable to change key type for Vault SSH certificate credential library using the UI
    </td>
    <td style={{verticalAlign: 'middle'}}>
    When you attempted to change the key type for a Vault SSH certificate credential library using the UI, the update failed.
    <br/><br />
    This issue is resolved in version 0.19.2. You can now change the key type using the UI.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.19.0
    <br /><br />
    (Fixed in 0.19.2)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    CVE-2025-22873
    </td>
    <td style={{verticalAlign: 'middle'}}>
    The version of Go that was used in Boundary release 0.19.x contained a security vulnerability. Although this vulnerability did not affect Boundary, release 0.19.2 was updated to use a new version of Go.
    <br/><br />
    Learn more:
    <br /><br />
    <a href="https://github.com/golang/go/issues/73555">CVE-2025-22873</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr id="hcp-grants">
    <td style={{verticalAlign: 'middle'}}>
    0.19.0
    <br /><br />
    (Fixed in 0.19.2)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    500 error when attempting to list resolvable aliases
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In HCP Boundary, you may receive a 500 error when you attempt to list resolvable aliases. This is a known issue that is caused by the way default grants were previously configured in HCP Boundary. The issue has been resolved, and any clusters that were created on or after April 26, 2025 should not have the issue.
    <br /><br />
    For any clusters created before April 26, 2025, you can add grants to resolve the error:
    <ol>
    <li>Create a role in the <code>global</code> scope and assign it to the <code>u_auth</code> user.</li>
    <li>Configure the role to apply to all <code>descendants</code> in the <code>global</code> scope.</li> <li>Assign the following grants to the role:
    <br /><br />
    <code>ids=&#123;&#123;.User.Id&#125;&#125;;type=user;actions=list-resolvable-aliases</code><br />
    <code>ids=*;type=target;actions=list,read</code>
    </li></ol>
    Learn more:
    <ul>
    <li><a href="/boundary/docs/api-clients/client-agent#grants">Boundary Client Agent grants</a> requirements</li>
    <li><a href="/boundary/docs/commands/roles/create"><code>roles create</code></a> command documentation</li>
    <li><a href="/boundary/docs/commands/roles/add-grant-scopes"><code>roles add-grant-scopes</code></a> command documentation</li>
    <li><a href="/boundary/docs/commands/roles/add-grants"><code>roles add-grants</code></a> command documentation</li>
    </ul>
    </td>
  </tr>

  <tr id="hcp-grants">
    <td style={{verticalAlign: 'middle'}}>
    0.18.0 - 0.19.0
    <br /><br />
    (Fixed in Boundary installer version 0.19.5)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Windows shortcuts are mandatory
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Previously, the Boundary installer for Windows always required you to install Desktop and Start menu shortcuts. This issue has been resolved, and you can now choose whether to install the shortcuts.
    <br /><br />
    Learn more: <a href="/boundary/docs/concepts/transparent-sessions">Transparent sessions</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr id="redundant-grants">
    <td style={{verticalAlign: 'middle'}}>
    0.15.0 - 0.19.2
    <br /><br />
    (Fixed in Boundary version 0.19.3)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Redundant grant scopes cause performance issues
    </td>
    <td style={{verticalAlign: 'middle'}}>
    You may have redundant grant scopes if you applied a grant to a scope and the scope also inherited the grant from the <code>this</code>, <code>children</code>, or <code>descendants</code> options. Redundant grant scopes could cause performance issues. As of Boundary version 0.19.3, redundant grant scopes are no longer permitted.
    <br /><br />
    When you run the <code>boundary database migrate</code> command to upgrade a Boundary Enterprise or Community edition cluster to version 0.19.3 or later, the migration will fail with a message if the database contains any redundant grant scopes. The migration tool provides the following command to automatically repair the grant scopes:
    <br /><br />
    <code>boundary database migrate -repair=oss:97001</code>
    <br /><br />
    Run the command to remove any redundant grant scopes from roles. Any individually granted scopes that are already covered by <code>descendants</code> or <code>children</code> grants are considered invalid and removed. When the migration is complete, the migration tool produces a message that details any changes.
    <br /><br />
    HCP Boundary automatically removes the redudant grant scopes as part of the upgrade process. No further action is required.
    <br /><br />
    Learn more:
      <ul>
      <li><a href="/boundary/docs/concepts/domain-model/scopes">Scopes</a></li>
      <li><a href="/boundary/docs/commands/roles/add-grant-scopes"><code>roles add-grant-scopes</code></a> command documentation</li>
      <li><a href="/boundary/docs/commands/roles/remove-grant-scopes"><code>roles remove-grant-scopes</code></a> command documentation</li>
      <li><a href="/boundary/docs/commands/roles/set-grant-scopes"><code>roles set-grant-scopes</code></a> command documentation</li>
      </ul>
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr id="redundant-grants">
    <td style={{verticalAlign: 'middle'}}>
    Client Agent 0.1.4 - 0.19.5
    <br /><br />
    (Fixed in Client Agent version 0.19.6)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Transparent session connection and DNS resolution issues
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Two known issues that affected transparent sessions were resolved with the release of Client Agent version 0.19.6:
    <ul>
      <li>If you established an SSH transparent session and then canceled the connection, you may have had trouble reconnecting.</li>
      <li>If you switched network interfaces between Wi-Fi and Ethernet while the Client Agent was running, you may have experienced connectivity issues with some applications.</li>
    </ul>
    These connection issues have been resolved in Client Agent version 0.19.6, install the new version to ensure that you do not experience them.
    <br /><br />
    Learn more: <a href="/boundary/docs/concepts/transparent-sessions">Transparent sessions</a>
    <br /><br />
    <a href="/boundary/docs/install-boundary/install-clients">Upgrade to the latest version of the Boundary clients</a>
    </td>
  </tr>


  </tbody>
</table>
