What's Changed

Exciting New Features 🎉

• feat(oo7): add the oo7 keyring backend by @runlevel5 in #508

Dependencies 👒

• chore(deps): Bump the go-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #510

New Contributors

• @runlevel5 made their first contribution in #508

Full Changelog: v7.17.7...v7.18.0

What's Changed

Dependencies 👒

• chore: bump to Go 1.27 by @mbevc1 in #505
• chore(deps): Bump the go-dependencies group across 1 directory with 8 updates by @dependabot[bot] in #506

Full Changelog: v7.17.6...v7.17.7

What's Changed

Dependencies 👒

• chore(deps): Bump the go-dependencies group across 1 directory with 8 updates by @dependabot[bot] in #504

Full Changelog: v7.17.5...v7.17.6

What's Changed

Dependencies 👒

• chore(deps): Bump github.com/byteness/keyring from 1.14.1 to 1.15.0 in the go-dependencies group across 1 directory by @dependabot[bot] in #503

Full Changelog: v7.17.4...v7.17.5

What's Changed

Bug fixes 🐛

• fix(sso): print the device code next to the sign-in URL by @mbevc1 in #501

Dependencies 👒

• chore(deps): Bump the go-dependencies group across 1 directory with 4 updates by @dependabot[bot] in #502

Full Changelog: v7.17.3...v7.17.4

What's Changed

Dependencies 👒

• chore(deps): Bump the go-dependencies group across 1 directory with 8 updates by @dependabot[bot] in #500

Full Changelog: v7.17.2...v7.17.3

What's Changed

Dependencies 👒

• chore(deps): Bump github.com/aws/smithy-go from 1.28.5 to 1.28.6 in the go-dependencies group across 1 directory by @dependabot[bot] in #499

Full Changelog: v7.17.1...v7.17.2

What's Changed

Dependencies 👒

• chore(deps): Bump github.com/gofrs/flock from 0.13.0 to 0.13.1 in the go-dependencies group across 1 directory by @dependabot[bot] in #497
• chore(deps): Bump github.com/byteness/keyring from 1.14.0 to 1.14.1 in the go-dependencies group across 1 directory by @dependabot[bot] in #498

Full Changelog: v7.17.0...v7.17.1

Highlights

Parallel-safe mode (opt-in)

A new --parallel-safe flag (or AWS_VAULT_PARALLEL_SAFE=true) makes it safe to run many aws-vault processes at once, such as hundreds of credential_process calls from Terraform. It adds cross-process locks so that:

• only one process per SSO start URL refreshes the token or opens a browser sign-in, while the others wait for the cached token
• only one process at a time writes a given cached session
• keyring access is serialized, with one lock per store
• SSO GetRoleCredentials rate limits (HTTP 429) are retried with jittered backoff, honouring Retry-After

It's off by default, and without it nothing changes. Every process running at the same time needs it, so setting the environment variable is the easiest way. Lock files live in aws-vault/locks under your user cache directory. See Parallel-safe mode.

Thanks to @timvisher-dd, who wrote the original in #337, and to @posquit0 for rebasing it in #476.

Touch ID only when the keychain is locked (macOS)

With --biometrics, every aws-vault process asked for Touch ID, including every credential_process call. keyring v1.14.0 checks whether the keychain is locked and only prompts then, so how often you see it now follows your keychain's lock settings. See Touch ID. Fixes #421.

Behaviour change

• aws-vault exec --json with --server, --ecs-server or --ec2-server now fails with an error (exit code 1). Before, it printed credentials, ignored the server flag and exited 0. (#492)

What's Changed

Exciting New Features 🎉

• feat: bump keyring to v1.14.0 so Touch ID only prompts when locked by @mbevc1 in #493
• feat: allow aws-vault to safely be run in parallel (rebase of #337 onto main) by @posquit0 in #476

Bug fixes 🐛

• fix(exec): validate flags on the --json path too by @mbevc1 in #492
• fix(sso): tighten the --parallel-safe token cache and 429 retry by @mbevc1 in #494
• fix(lock): open keyrings under the keyring lock by @mbevc1 in #495
• fix(lock): key keyring locks by the store, not its spelling by @mbevc1 in #496

Dependencies 👒

• chore(deps): Bump github.com/byteness/keyring from 1.13.2 to 1.13.3 in the go-dependencies group across 1 directory by @dependabot[bot] in #490

New Contributors

• @posquit0 made their first contribution in #476

Full Changelog: v7.16.3...v7.17.0

What's Changed

Bug fixes 🐛

• fix: handle Windows Credential Manager size limits gracefully by @mbevc1 in #488

Dependencies 👒

• chore(deps): Bump the go-dependencies group across 1 directory with 7 updates by @dependabot[bot] in #486
• chore(deps): Bump the go-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #489

Full Changelog: v7.16.2...v7.16.3