Releases

This release makes a number of breaking changes. Most notably, dropping support for Python 3.6 & 3.7, dropping support for Vault versions 1.6.x through 1.10.x, and removing previously deprecated methods and code paths. Most of the other breaking changes are fairly minor or only affect specific use cases, but please review all changes carefully.

There are also several other deprecations and announcements to be aware of. We hope to have a more rapid release schedule going forward.

In accordance with our supported Python version policy we will continue to drop Python versions as they become end-of-life. These may not be announced in advance, but will be done in major versions.

💥 Breaking Changes

• Client.write method breaking changes 2.0.0 (GH-1089)
• Drop support for Vault 1.6-1.10 (GH-1074)
• Changing default values for sys.initialize parameters secret_shares and secret_threshold (GH-1063)
• Remove old deprecated client attributes (GH-1062)
• Remove MFA class (GH-1056)
• adapters: if session is user-supplied, do not overwrite session options with Client/Adapter options (GH-1021)
• Make pyhcl optional again (GH-1060)
• Drop Python 3.6 & 3.7, Add Python 3.11, bump some dependencies (GH-1048)

📢 Deprecations / Announcements

• Breaking changes coming to Adapters’ use of custom sessions (GH-1040)
• Breaking changes coming to Client.write method (GH-1034)
• The default value of raise_on_deleted_version will change from True to False in v3.0.0 (GH-955)
• The certificate parameter for create_ca_certificate_role will stop accepting file paths in v3.0.0 (GH-914)
• Drop support for Vault 1.6-1.10 (GH-1074)
• Changing default values for sys.initialize parameters secret_shares and secret_threshold (GH-1063)
• Fix typo in safety_buffer argument in AWS auth (GH-1068)

🚀 Features

• Add support for Python 3.12 (GH-1073)
• Database Secrets Engine – add rotate_static_credentials method, docs updates, unit tests (GH-1069)
• Make plaintext and ciphertext optional for batch operations (GH-1049)

🐛 Bug Fixes

• Changing default values for sys.initialize parameters secret_shares and secret_threshold (GH-1063)
• adapters: if session is user-supplied, do not overwrite session options with Client/Adapter options (GH-1021)

📚 Documentation

• update docstring for sys step-down (GH-1086)
• Database Secrets Engine – add rotate_static_credentials method, docs updates, unit tests (GH-1069)
• Fix invalid build and test status (GH-1072)

🧰 Miscellaneous

• add .git-blame-ignore-revs (GH-1087)
• Fix typos, add typos linter to CI (GH-1057)
• drop python-jwt dev dependency (GH-1084)

Thanks to @Tylerlhess, @amiewei, @briantist, @cibinmathew and @dosisod for their lovely contributions.

Check it out on GitHub!

This release fixes an inaccuracy in a warning message but does not otherwise change functionality.

🐛 Bug Fixes

• Fix raise_on_deleted_version warning (GH-1045)

Thanks to @briantist and @iTrooz for their lovely contributions.

Check it out on GitHub!

This is the last expected release before v2.0.0.

📢 Deprecations / Announcements

• ldap auth method – add missing configure params by vault api names (GH-975)
• expand Vault CI matrix, announce deprecation of Vault dynamic SSH keys (GH-1023)
• Breaking changes coming to Client.write method (GH-1034)
• Support for Python 3.6 & 3.7 will be dropped in v2.0.0 (GH-877)
• Support for the Legacy MFA methods will be dropped from the MFA class in v2.0.0 (GH-1026)
• Breaking changes coming to Adapters’ use of custom sessions (GH-1040)

🚀 Features

• Add alias_name_source for Kubernetes Auth create_role (GH-1039)
• add Client.write_data method (GH-1028)
• ldap auth method – add missing configure params by vault api names (GH-975)
• Re-add arguments to create_or_update_role() from old API (GH-842)
• Add new argument (conflicting_alias_ids_to_keep) to merge_entities method (GH-968)
• Add impersonated account support to GCP secrets engine (GH-1022)
• support “user_claim_json_pointer” in create_role() for JWT/OIDC auth method (GH-1006)
• Add static account support to GCP secrets engine (GH-956)
• adding batch_input to transit.sign_data #988 (GH-990)
• Add a method to read static roles in the database engine (GH-1009)
• feat: add support for disable_local_ca_jwt in the Kubernetes auth method (GH-997)

🐛 Bug Fixes

• add Client.write_data method (GH-1028)
• Fix premature read on stream requests in the sys.take_raft_snapshot method (GH-771)
• fix(__getattr__): non-existent attribute lookup (GH-982)

📚 Documentation

• docs(secrets-engines): Add database secrets engine docs (GH-1036)
• docs: make OIDC Authorization URL Request example work again. (GH-1010)

🧰 Miscellaneous

• add tests and docs to sdist, improve build testing (GH-1015)
• Bump certifi from 2022.9.14 to 2022.12.7 (GH-1013)

Thanks to @M0NsTeRRR, @amiewei, @briantist, @ceesios, @crimsonvulture, @deidax, @dekimsey, @dependabot, @dependabot[bot], @fad3t, @ferenc-hechler, @intgr, @m4dh4t, @michael-diggin, @mimato, @mweigel and @robbat2 for their lovely contributions.

Check it out on GitHub!

🐛 Bug Fixes

• fix wrapped response for auth.token.create (GH-966)

Thanks to @briantist for their lovely contributions.

Check it out on GitHub!

📢 Deprecations / Announcements

• v3.0.0 – The certificate parameter for create_ca_certificate_role will stop accepting file paths (GH-914)
• Please note that hvac intends to drop support for EoL Python versions (GH-877)
• v3.0.0 – The default value of raise_on_deleted_version will change from True to False (GH-955)
• Allow for reading deleted secret versions (kv2) without an exception (GH-907)

🚀 Features

• Allow for reading deleted secret versions (kv2) without an exception (GH-907)
• AWS secret engine – fix generate_credentials for STS endpoint (GH-934)
• Add support for custom metadata in kv2 engine (GH-805)
• Add new field auto_rotate_period on transit key management (GH-903)

🐛 Bug Fixes

• Allow for reading deleted secret versions (kv2) without an exception (GH-907)
• fix vault client certificates loaded from envirnoment variables (GH-943)
• approle – fix metadata for generated secret IDs, re-add wrap_ttl (GH-782)
• AWS secret engine – fix generate_credentials for STS endpoint (GH-934)
• Propagate client’s adapter to API categories (GH-939)
• don’t cache on py3.6 windows combo (GH-916)
• Cert: Fix role certificate parameter (GH-886)

📚 Documentation

• add documentation for retries (GH-948)
• docs – sphinx – fail on warnings (GH-949)
• Create userpass.rst (GH-775)
• doc: update reference to removed method (GH-942)
• Documentation updates for use with a private CA (GH-774)
• Update Azure guideline with proper client variable (GH-935)
• Update wrapping.rst – example for unauthenticated unwrap (GH-789)
• Fix typo in the AWS auth method docs (GH-911)
• Replace Azure docs occurence to Kubernetes (GH-904)

🧰 Miscellaneous

• Remove deprecated python syntax (GH-909)

Thanks to @BrandonHoffman, @Prividen, @WilkenSteiner, @aberenshtein, @adammike, @bendem, @briantist, @colin-pm, @dereckson, @dhuckins, @gmsantos, @jackcasey-visier, @localden, @nneul, @rhowe and @sebglon for their lovely contributions.

Check it out on GitHub!