CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/vault 2.2.1

Tool for securely accessing secrets

Port info

Maintainer
bofh@FreeBSD.org
Packages
latest: 2.2.1
Upstream
up to date
Last update
to 2.2.1 · f460c4b509
Quarterly
2026Q4: 2.1.2_1 · last MFH 60647eff54
WWW
https://vaultproject.io/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vault
installs 2.2.1 from latest; from quarterly (2026Q4) 2.1.2_1
Port
# cd /usr/ports/security/vault && make install clean
Size
67 MiB download · 387 MiB installed
Depends on
nothing
License
MPL20
Creates
user vault, group vault
pkg-message
Shown after installing
The vault user created by the vault package is now a member of the daemon
class, which will allow it to use mlock() when started by the rc script. This
will not be reflected in systems where the user already exists. Please add the
vault user to the daemon class manually by running:

pw usermod -L daemon -n vault

or delete the user and reinstall the package.

You may also need to increase memorylocked for the daemon class in
/etc/rc.conf to more than 1024M (the default) or more:

vault_limits_mlock="2048M"

Or to disable mlock, add:

disable_mlock = 1

to /usr/local/etc/vault.hcl

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.2.12.1.2–
FreeBSD 152.2.12.2.0–
FreeBSD 142.2.0_12.1.2✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.1.2_12.1.2–
FreeBSD 142.1.2_12.1.2✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 2.2.1.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (173)

Dmitri Goutnik (dmgk) · 1.8.7_11
all: Bump PORTREVISION after Go ports update
09079730e9
Dmitri Goutnik (dmgk) · 1.8.7_10
all: Bump PORTREVISION after lang/go{119,120} update
56b5ec772f
Dmitri Goutnik (dmgk) · 1.8.7_9
all: Bump PORTREVISION after GO_DEFAULT update.
2297efc51b
Dmitri Goutnik (dmgk) · 1.8.7_8
all: Bump PORTVERSION after lang/go{118,119} update
3b383d833a
Dmitri Goutnik (dmgk) · 1.8.7_7
all: Bump PORTREVISION after lang/go{118,119} update
d9ad1002d5
Dmitri Goutnik (dmgk) · 1.8.7_6
all: Bump PORTREVISION after lang/go{118,119} update
bde51869ee
Dmitri Goutnik (dmgk) · 1.8.7_5
all: Bump PORTREVISION after lang/go{118,119} update
f05c98fffb
Stefan Eßer (se) · 1.8.7_4
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.8.7_4
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Dmitri Goutnik (dmgk) · 1.8.7_4
all: Bump PORTREVISION after Go update

Bump Go ports PORTREVISION after GO_DEFAULT and lang/go118 update.
4476f89764
Dmitri Goutnik (dmgk) · 1.8.7_3
all: Bump PORTREVISION after lang/go{117,118} update
153cb65ac8
Dmitri Goutnik (dmgk) · 1.8.7_2
*/*: Bump port revisons after lang/go{117,118} update
309cdeccd8
Guangyuan Yang (ygy) · 1.8.7_1
*/*: Bump PORTREVISION after lang/go 1.18 update
d690b5102f
Brad Davis (brd) · 1.8.7
security/vault: Update to 1.8.7

Approved by:	swills
6a19fa5c86
Michael Gmelin (grembo) · 1.8.2
security/vault: Fix build

Upstream broke v1.8.2 branch by accident, temporary fix by
cloning upstream on github, resetting the repo hard, and
changing github source. This way hashes in distinfo
stay the same (only the filename changes).

See also
https://github.com/swills/vaultui/commit/b91a8bb9#commitcomment-63640515

PR: 261125
Approved by: build fix blanket
8f5c169cc4
Stefan Eßer (se) · 1.8.2
security/vault: Add CPE information

Approved by:	portmgr (blanket)
3bc5d5b48c
Steve Wills (swills) · 1.8.2
security/vault: update to 1.8.2

While here, add vault_limits to rc script [1]

PR:		258332 [1]
Submitted by:	Tomoyuki Sakurai <trombik1973@gmail.com> [1]
dc9bd76440
Steve Wills (swills) · 1.7.3
security/vault: Update to 1.7.3
ca31c5ecae
Mathieu Arnold (mat) · 1.6.3
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 1.6.3
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 1.6.3
Remove # $FreeBSD$ from Makefiles.
305f148f48
Steve Wills (swills) · 1.6.3
security/vault: update to 1.6.3

Security:	52bd2d59-4ab5-4bef-a599-7aac4e92238b
d7e2ff460e
Steve Wills (swills) · 1.6.2
security/vault: update to 1.6.2

PR:		253194
Submitted by:	brd
3874d522df
Steve Wills (swills) · 1.6.1
security/vault: update to 1.6.1 [1]

While here, improve pkg-message and rc script [2]

PR:		251737 [2]
Submitted by:	brd [2]
5b4e187d5d
Steve Wills (swills) · 1.6.0
security/vault: update to 1.6.0
0e14054587
Steve Wills (swills) · 1.5.4
security/vault: update to 1.5.4
aae93a4fa6
Steve Wills (swills) · 1.5.3
security/vault: update to 1.5.3
3bc951f6db
Steve Wills (swills) · 1.5.2
security/vault: update to 1.5.2
ebacbcc4f2
Steve Wills (swills) · 1.5.0
security/vault: update to 1.5.0
dc4e2a569c
Steve Wills (swills) · 1.4.3
security/vault: update to 1.4.3
f46b591e8c
Steve Wills (swills) · 1.4.1
security/vault: Update to 1.4.1

PR:		246251
Reported by:	michael.glaus@hostpoint.ch
09299604c6
Steve Wills (swills) · 1.3.4
security/vault: fix build on aarch64

This also changes the port to use the vendored deps

PR:		245157
Submitted by:	mikael
4e906c02ba
Steve Wills (swills) · 1.3.4
security/vault: update to 1.3.4
846fae399b
Steve Wills (swills) · 1.3.0
security/vault: update to 1.3.0
e16b1e12eb
Steve Wills (swills) · 1.2.4
security/vault: fix fetch
b5740ef078
Steve Wills (swills) · 1.2.4
security/vault: update to 1.2.4
3cb54f7d11
Steve Wills (swills) · 1.1.2_1
security/vault: Unbreak with go1.13

PR:		240075
Submitted by:	Dmitri Goutnik <dg@syrec.org>
45d25cc7f7
Mathieu Arnold (mat) · 1.1.2_1
Convert to UCL & cleanup pkg-message (categories s)
bc89cd3d2c
Tobias Kortkamp (tobik) · 1.1.2_1
Convert all Go ports to USES=go

This allows for port testing with lang/go-devel via GO_PORT, setting
up the Go build environment in a single place, and is step one in
simplifying Go ports that often define too complicated do-build
targets themselves.

USES=go gains new arguments 'run' to add lang/go to RUN_DEPENDS and
'no_targets' for ports with composite builds that call 'go' themselves
and do not need the do-build/do-install targets of USES=go.

PR:		238849
Submitted by:	dg@syrec.org (also D20745)
Reviewed by:	mat, tobik
Exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D20746
3726f94254
Steve Wills (swills) · 1.1.2_1
security/vault: add vault user to daemon class

This allows use of mlock() when vault is started via rc script.

Submitted by:	dch
Reviewed by:	jrm
Differential Revision:	https://reviews.freebsd.org/D20025
1a9ac8c93a
Steve Wills (swills) · 1.1.2
security/vault: update to 1.1.2
7c3c209b7e
Steve Wills (swills) · 1.0.2
security/vault: update to 1.0.2
892513376f
Steve Wills (swills) · 1.0.1
security/vault: update to 1.0.1

While here, fix UI
2af61187c6
Steve Wills (swills) · 1.0.0
security/vault: update to 1.0.0
d1a120aa32
Steve Wills (swills) · 0.11.4
security/vault: update to 0.11.4
2901d32af3
Steve Wills (swills) · 0.11.1
security/vault: update to 0.11.1
cfbe2efcb2
Steve Wills (swills) · 0.10.3_1
security/vault: improve rc.d script

- Add additional "monitor" command which throws statistics to stdout.
  For details, see https://www.vaultproject.io/docs/internals/telemetry.html
- Where possible, add additional "vault_syslog_output_*" rc vars to redirect stdout to syslog
- Add vault config to required files list
- Bump PORTREVISION to reflect package

PR:		215896
Submitted by:	Pavel Timofeev <timp87@gmail.com> (with modifications)
f77bf40c09
Steve Wills (swills) · 0.10.3
security/vault: update to 0.10.3
09d5f7091a
Steve Wills (swills) · 0.10.2
security/vault: update to 0.10.2
a632619117
Steve Wills (swills) · 0.10.1
security/vault: update to 0.10.1
337a79c2f8