Skip to content

v2.2.0

Choose a tag to compare

View all tags
@kurok kurok released this 01 Sep 15:42
· 16 commits to master since this release
v2.2.0
1bb605d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Additive release — no breaking changes. Verified against published 2.1.2: the public surface is identical (same export shape, 3 statics, 14 instance methods, every arity, 6 error classes and hierarchy), and 26 behavioural scenarios run against both versions on a live Vault produced identical results — including unknown extra option keys, the legacy auth.config.namespace, partial loggers, boot() with differing options, and the error types raised on each failure path.

Added

  • JWT/OIDC auth backend (auth.type: 'jwt', default mount jwt) for workload identity federation — GitHub Actions, other CI, GCP/Azure/SPIFFE. Exactly one of three mutually-exclusive token sources: a literal config.jwt, a config.jwtPath re-read on every login, or an (optionally async) config.jwtProvider invoked fresh at login time. The non-interactive jwt flow only; the browser-redirect oidc flow is out of scope for a service client.
  • Token renewal controls. auth.renewal: false disables the background renewal timer; auth.renewalFraction (default 0.5) tunes when renewal happens; auth.renewalIncrement requests extra TTL. All validated at construction. Defaults reproduce previous behaviour exactly.
  • First-party TypeScript declarations — index.d.ts plus src/errors.d.ts, referenced by the types field. auth is a discriminated union on type, and the three JWT sources are enforced at compile time. If you have @types/node-vault-client installed, uninstall it: it stops at the 1.x API and declared runtime exports that do not exist.

Fixed

  • Stale renewal callbacks no longer act on state they no longer own. A renewal in flight when the token was replaced, or when close() / cancelTokenRefresh() ran, could overwrite the newer token, leave a live token permanently un-renewed, or re-arm a timer on a closed client.
  • VaultClient.boot() now logs a warning when called for a name that already exists with different options. The options were, and still are, ignored — this only makes a previously silent mismatch visible.

Documentation

  • How to import the error classes (node-vault-client/src/errors) — previously named throughout the README with no importable path.
  • Lease.getMetadata() added to the Lease API list.
  • Transport behaviour that was true but unwritten: there is no default request timeout; the undici you install must be interface-compatible with the one Node bundles (on Node 24, undici@8 dispatchers are rejected outright — pin undici@^7); a shared AbortSignal.timeout() in requestOptions aborts every request after the first; and redirects forward X-Vault-Token across origins, so api.url and its DNS are trusted infrastructure.

Verification

Green on both supported Vault lines (1.21 and 2.0) — unit, e2e, KV v2, JWT and the example app — with 411 tests passing, 98.99% coverage, 0 audit vulnerabilities, and the packed artifact installed into a clean project and required before publishing.

Full detail in CHANGELOG.md.

Assets 2
Loading