Skip to content

v2.0.1

Choose a tag to compare

View all tags
@kurok kurok released this 17 Jun 08:36
· 138 commits to master since this release
v2.0.1
c675eb8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release on top of v2.0.0 (2026-06-16). No public API breaks.

Security

  • Stop logging secrets at debug level. The Kubernetes auth backend no longer logs the service-account JWT or the issued Vault client token, and VaultApiClient no longer logs full response bodies (which carry auth tokens and secret reads). Debug logs now record only non-sensitive metadata — token paths, request method/URI, and HTTP status codes. (#89)

Changes

  • Reject malformed substitution values whose path or key is empty (e.g. #value or path#) with InvalidArgumentsError, instead of failing later with a less clear error.

Dependencies

  • Drop four runtime dependencies. bluebird and assign-deep are replaced with native promises and lodash; pretty-ms and url-join are inlined as small helpers (their latest majors are ESM-only and cannot be used from this CommonJS package). The lodash floor is raised to ^4.17.21. Runtime dependencies are now @aws-sdk/credential-providers, aws4, lodash, and long-timeout. (#90, #93)

CI / maintenance

  • Switch npm publish to trusted publishing (OIDC). (#85)
  • Split unit and Vault-backed e2e tests into separate jobs. (#87)
  • Address AI code-quality findings. (#91, #92)

Full details in CHANGELOG.md.

Assets 2
Loading