Skip to content

v2.1.0

Choose a tag to compare

View all tags
@kurok kurok released this 28 Jul 07:17
v2.1.0
7b359a3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Minor release on top of v2.0.4 (2026-07-02). No breaking changes.

Added

  • VaultHttpError — non-2xx Vault responses now reject with a typed error in the VaultError hierarchy (exported from the errors module), so callers can instanceof-check HTTP failures. The message ("<status> - <body text>") and the statusCode/error properties are unchanged, and the thrown value is still an instanceof Error.
  • opts.maxCacheSize — the mount cache is now a bounded LRU (default 500 entries).

Changed

  • Auth backends now fail fast with InvalidArgumentsError when a required config field is missing (role_id for AppRole, role for IAM and Kubernetes). Valid configurations behave exactly as before.

Performance

  • MountResolver no longer re-sorts the api.engines override map on every resolve() (normalized/sorted once at construction, and snapshotted), and the mount cache is probed by segment-boundary prefix in O(path depth) instead of a linear scan. Measured at 200k worst-case resolves: engines lookup 1191ms → 34ms (50 entries), cache lookup 1019ms → 149ms (500 mounts). (#108)

Internal

  • Unified the copy-pasted VaultClient request pipeline behind a single __resolveAndRequest entry point, locked by new characterization tests across v1/v2 mounts, namespaces, and extra headers. No behavior change. (#110)

Security

  • Pin patched transitive dev tooling via overrides: brace-expansion@^5.0.8 (clears GHSA-3jxr-9vmj-r5cp / Dependabot #60 and GHSA-mh99-v99m-4gvg) and js-yaml@^4.3.0 (clears the quadratic-CPU merge-key advisory). Dev/transitive only — no runtime dependency or behavior change.
Assets 2
Loading