chore(release): 2.0.0

[kurok]

Release 2.0.0

Cuts a new release off master. Last published release was v1.0.1 (2024-06-07). This is a major bump because master contains breaking changes (see CHANGELOG).

Note: there is a stale 1.0.2 Draft release / tag on a divergent line that never landed on master (package.json was still 1.0.1). This release moves straight to 2.0.0 to reflect the breaking changes and avoid the orphaned 1.0.2.

Changes in this PR

• package.json: 1.0.1 → 2.0.0
• package-lock.json: root + packages[""] version → 2.0.0
• CHANGELOG.md: convert # Unreleased → # 2.0.0. Release notes (2026-06-12)

Changelog (highlights since v1.0.1)

• [BREAKING] Minimum supported Node.js is now 18.0.0 (was 14.0.0); the client relies on native fetch.
• Replace deprecated request/request-promise with Node's native fetch (removes the request runtime dependency). Closes fix(deps): replace request with native fetch to clear Dependabot alerts #59.
• Add api.requestOptions, shallow-merged into every fetch() call (proxy/SOCKS agent, self-signed/internal-CA via undici dispatcher). Closes add config an http agent #37, RequestError: Error: self signed certificate in certificate chain #29.
• Fix process never exiting after reading with a renewable token; add VaultClient#close() / VaultBaseAuth#cancelTokenRefresh(); VaultClient.clear() now closes removed instances. Closes Blinking input cursor after running read #31.
• IAM auth: optional region config; STS GetCallerIdentity signed against the regional endpoint, fixing SignatureDoesNotMatch on non-us-east-1. Closes With IAM Authentication not able to pass region #25.
• Auth token: derive expiry from Vault's expire_time (RFC3339), falling back to ttl. Closes Token expiry derived from creation_time + ttl instead of the documented expire_time #51.
• Raise AuthTokenExpiredError for expired non-refreshable tokens instead of using a stale token. Closes Unreachable AuthTokenExpiredError: expired non-refreshable tokens are returned instead of raising #50.
• Replace deprecated new Buffer() with Buffer.from() in IAM STS body encoding. Closes Deprecated new Buffer() in VaultIAMAuth (DEP0005) #52.

Full details in CHANGELOG.md.

Notes

• No npm publish / GitHub release is performed by this PR — it exists so the diff and changelog can be reviewed. Publishing happens via the existing release workflow after merge.

[kurok]

Please check diffs between releases