v3.0.0
3.0.0 (2026-05-15)
⚠ BREAKING CHANGES
- implications for IntegTestUtil consumers.
https://claude.ai/code/session_01LbWtFPLw9GBJxkZfPis5Lo
- feat!: remove axios runtime dependency in favor of native fetch
Replace axios with the platform-native fetch API across the library:
- src/lambda/auth.ts: JWKS and well-known issuer lookups now use fetch
with a 5s AbortSignal timeout. Errors surface as Error instead of
AxiosError; visible authorizer behavior is unchanged. - src/tests/integ-test-util.ts: getClient() and getAuthenticatedClient()
now return a small HttpClient backed by fetch (BREAKING). The new
client exposes get/post/put/patch/delete; response shape changes from
axios's { data, status } to { body, status, ok, headers, json() }. - src/tests/http-client.ts: new minimal HttpClient with baseURL and
default-header support. - package.json / .projenrc.ts: drop axios from runtime dependencies.
Motivation is supply-chain security: axios has had repeated security
advisories and removing it permanently is cheaper than chasing CVE
upgrades. Lambda already runs Node 22 (Runtime.NODEJS_LATEST), so
fetch is available natively.
Migration notes for IntegTestUtil consumers are documented in README.
https://claude.ai/code/session_01LbWtFPLw9GBJxkZfPis5Lo
- chore: self mutation
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>