v15.4.31

gravitational/teleportv15.4.31Apr 9, 2025by fheinecke

AI Summary

Teleport v15.4.31 is a patch release focused on bug fixes, performance improvements, and security updates. Key fixes include resolving a panic when trimming audit log entries, fixing a high CPU usage bug in reverse tunnel agents, and addressing CVE-2025-22870 through an updated golang.org/x/net dependency. The release also adds DynamoDB Streams FIPS endpoint support and improves resource consumption for Kubernetes certificate generation.

Key Highlights

Fixed panic when trimming audit log entries (#53308)
Fixed rare high CPU usage bug in reverse tunnel agents (#53283)
Updated golang.org/x/net to address CVE-2025-22870 (#52848)
Improved resource consumption for Kubernetes certificate generation via `tctl auth sign` and `tsh kube login` (#52148)
Added support for DynamoDB Streams FIPS endpoints (#53203)

New Features

Added support for using DynamoDB Streams FIPS endpoints
Kubernetes app discovery now supports annotation for apps served on sub-path of HTTP service
Event handler can now generate certificates for non-resolvable DNS names
Added `--join-method` flag to `teleport configure` command
Improved resource consumption when retrieving resources via Web UI or `tsh ls`

Full Release Notes

## Description

* Fixed throttling in the DynamoDB backend event stream for tables with a high amount of stream shards. [#53806](https://github.com/gravitational/teleport/pull/53806)
* Fixed `tsh proxy db` not honoring `--db-roles` when renewing certificates. [#53447](https://github.com/gravitational/teleport/pull/53447)
* Fixed a panic when trimming audit log entries. [#53308](https://github.com/gravitational/teleport/pull/53308)
* Improved resource consumption when retrieving resources via the Web UI or `tsh ls`. [#53304](https://github.com/gravitational/teleport/pull/53304)
* Fixed a rare high CPU usage bug in reverse tunnel agents. [#53283](https://github.com/gravitational/teleport/pull/53283)
* Add support for using DynamoDB Streams FIPS endpoints. [#53203](https://github.com/gravitational/teleport/pull/53203)
* Fixed the default CDN Base URL for client tools managed updates being incorrectly required OSS builds. [#53173](https://github.com/gravitational/teleport/pull/53173)
* Kubernetes app discovery now supports an additional annotation for apps that are served on a sub-path of an HTTP service. [#53096](https://github.com/gravitational/teleport/pull/53096)
* Fixed an issue causing the teleport process to crash on group database errors when host user creation was enabled. [#53081](https://github.com/gravitational/teleport/pull/53081)
* The event handler can now generate certificates for DNS names that are not resolvable. [#53064](https://github.com/gravitational/teleport/pull/53064)
* Added a `--join-method` flag to the `teleport configure` command. [#53059](https://github.com/gravitational/teleport/pull/53059)
* Web UI now correctly displays errors in desktop sessions when a required WebAuthn MFA device is missing. [#52918](https://github.com/gravitational/teleport/pull/52918)
* Fixed desktop session recordings sometimes not having incorrect proportions. [#52869](https://github.com/gravitational/teleport/pull/52869)
* Resolved an issue that could cause WebSocket errors to appear after the graceful shutdown of a desktop session. [#52869](https://github.com/gravitational/teleport/pull/52869)
* Updated golang.org/x/net (addresses CVE-2025-22870). [#52848](https://github.com/gravitational/teleport/pull/52848)
* Improve latency and reduce resource consumption of generating Kubernetes certificates via `tctl auth sign` and `tsh kube login`. [#52148](https://github.com/gravitational/teleport/pull/52148)

Enterprise:
* Reduce resource consumption resolving Okta applications during login. [#6087](https://github.com/gravitational/teleport.e/pull/6087)

## Download
Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v15.4.31-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v15.4.31-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v15.4.31-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v15.4.31-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v15.4.31-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v15.4.31-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v15.4.31-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v15.4.31-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v15.4.31-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v15.4.31-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v15.4.31-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v15.4.31-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v15.4.31-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v15.4.31-linux-arm64-bin.tar.gz)