open-vault/website/content/docs/upgrading/upgrade-to-1.2.0.mdx

---
layout: docs
page_title: Upgrading to Vault 1.2.0 - Guides
description: |-
  This page contains the list of deprecations and important or breaking changes
  for Vault 1.2.0. Please read it carefully.
---

# Overview

This page contains the list of deprecations and important or breaking changes
for Vault 1.2.0 compared to 1.1.0. Please read it carefully.

## Known issues

### AppRole upgrade issue

Due to a bug, on upgrade AppRole roles cannot be read properly. If using AppRole, do not upgrade until this issue is fixed in 1.2.1.

## Changes/Deprecations

### Path character handling

Due to underlying changes in Go's runtime past version 1.11.5, Vault is now
stricter about what characters it will accept in path names. Whereas before it
would filter out unprintable characters (and this could be turned off), control
characters and other invalid characters are now rejected within Go's HTTP
library before the request is passed to Vault, and this cannot be disabled. To
continue using these (e.g. for already-written paths), they must be properly
percent-encoded (e.g. `\r` becomes `%0D`, `\x00` becomes `%00`, and so on).

### AWSKMS seal region

The user-configured regions on the AWSKMS seal stanza will now be preferred
over regions set in the enclosing environment.

### Audit logging of empty values

All values in audit logs now are omitted if they are empty. This helps reduce
the size of audit log entries by not reproducing keys in each entry that
commonly don't contain any value, which can help in cases where audit log
entries are above the maximum UDP packet size and others.

### Rollback logging

Rollback will no longer display log messages when it runs; it will only display
messages if an error occurs.

### Database plugins

Database plugins now default to 4 max open connections rather than 2. This
should be safe in nearly all cases and fixes some issues where a single
operation could fail with the default configuration because it needed three
connections just for that operation. However, this could result in an increase
in held open file descriptors for each database configuration, so ensure that
there is sufficient overhead.

### AppRole various changes

- AppRole uses new, common token fields for values that overlap with other auth
  methods. `period` and `policies` will continue to work, with priority being
  given to the `token_` prefixed versions of these fields, but the values for
  those will only be returned on read if they were set initially.
- `default` is no longer automatically added to policies after submission. It
  was a no-op anyways since Vault's core would always add it, and changing this
  behavior allows AppRole to support the new `token_no_default_policy`
  parameter
- The long-deprecated `bound_cidr_list` is no longer returned when reading a
  role.

### Token store roles changes

Token store roles use new, common token fields for the values that overlap with
other auth backends. `period`, `explicit_max_ttl`, and `bound_cidrs` will
continue to work, with priority being given to the `token_` prefixed versions
of those parameters. They will also be returned when doing a read on the role
if they were used to provide values initially; however, in Vault 1.4 if
`period` or `explicit_max_ttl` is zero they will no longer be returned.
(`explicit_max_ttl` was already not returned if empty.)

### Go API/SDK changes

Vault now uses Go's official dependency management system, Go Modules, to
manage dependencies. As a result to both reduce transitive dependencies for API
library users and plugin authors, and to work around various conflicts, we have
moved various helpers around, mostly under an `sdk/` submodule. A couple of
functions have also moved from plugin helper code to the `api/` submodule. If
you are a plugin author, take a look at some of our official plugins and the
paths they are importing for guidance.

### Change in LDAP group CN handling

A bug fix put in place in Vault 1.1.1 to allow group CNs to be found from an
LDAP server in lowercase `cn` as well as uppercase `CN` had an unintended
consequence. If prior to that a group used `cn`, as in `cn=foo,ou=bar` then the
group that would need to be put into place in the LDAP plugin to match against
policies is `cn=foo,ou=bar` since the CN would not be correctly found. After
the change, the CN was correctly found, but this would result in the group name
being parsed as `foo` and would not match groups using the full DN. In 1.1.5+,
there is a boolean config setting `use_pre111_group_cn_behavior` to allow
reverting to the old matching behavior; we also attempt to upgrade exiting
configs to have that defaulted to true.

### JWT/OIDC plugin

Logins of role_type "oidc" via the /login path are no longer allowed.

### ACL wildcards

New ordering put into place in Vault 1.1.1 defines which policy wins when there
are multiple inexact matches and at least one path contains `+`. `+*` is now
illegal in policy paths. The previous behavior simply selected any matching
segment-wildcard path that matched.

### Replication

Due to technical limitations, mounting and unmounting was not previously
possible from a performance secondary. These have been resolved, and these
operations may now be run from a performance secondary.