@bymax-one/nest-logger 1.2.6 → 1.2.7

package/CHANGELOG.md

@@ -11,6 +11,107 @@ heading here.
 
 ## [Unreleased]
 
+## [1.2.7] - 2026-08-15
+
+### Security
+
+- **Serializer output is redacted by name under `redactStrategy: 'paths'` too.** Carrying an
+  error's own properties at every depth of the `cause` chain (below) opened a hole in that legacy
+  mode: the name walk is a pass-through there, so redaction fell entirely to `fast-redact`, and
+  `DEFAULT_REDACT_PATHS` reaches `*.*.*.*.password` — four wildcard levels. A serialized cause chain
+  goes deeper. Measured on the built artifact with a password on the deepest link of
+  `err.errors[0].cause.cause`:
+
+  ```json
+  { "cause": { "name": "Error", "message": "deep", "password": "LEAK-deep" } }
+  ```
+
+  Confirmed absent from `1.2.6`, where the field was not carried at all — so this was a regression
+  introduced inside this release rather than an inherited one, and it never reached a published
+  artifact.
+
+  `redactStrategy` is the consumer's choice about **their own payload**; what a serializer
+  synthesizes is this library's output, and the name walk — which has no depth ceiling — now covers
+  it either way. The caller's record is untouched by this: `'paths'` still means exactly what it
+  documented, four-level ceiling included, and the e2e case that pins that ceiling is what caught
+  the first attempt at this fix collapsing both hooks onto one redactor.
+
+  Reported by Copilot on the pull request that introduced the deeper copy.
+
+- **An own `__proto__` key on an error is now stored as data instead of being applied as a
+  prototype.** The own-property copy assigned each key, and `__proto__` is an accessor inherited
+  from `Object.prototype` — so the assignment walked the chain, invoked that setter, and replaced
+  the sanitized node's prototype. An error-like object arriving from JSON (a worker boundary, a
+  queue, an HTTP body) carries `__proto__` as an ordinary own enumerable key, and `Object.entries`
+  hands it over like any other.
+
+  Measured rather than assumed. `Object.prototype` itself is never touched, so this is prototype
+  injection into a single log node rather than global pollution, and with a JSON-sourced payload the
+  emitted line was unchanged — `JSON.stringify` ignores inherited fields. The live hazard is the
+  node: given `{"__proto__": null}` it loses `hasOwnProperty` and `toString`, which then **throw**
+  for anything downstream that touches them, inside the one path whose contract is that logging
+  never crashes the application.
+
+  The copy now defines an own data property, which makes the key inert and keeps its value — an
+  error that genuinely carries a `__proto__` field gets it logged as the data it is. Reported by
+  Copilot on the pull request that introduced the deeper copy.
+
+### Documentation
+
+- **`ignore` needs an escaped dot for `event.name`, and every example here taught the opposite.**
+  `pino-pretty` reads a dot as a nested path, and this library emits `event.name` as a literal
+  top-level key — so `ignore: '…,event.name'` looks for an `event` object with a `name` inside,
+  finds neither, and hides nothing without a word of complaint. Measured on one entry with only the
+  option changing:
+
+  ```
+  ignore: '…,event.name'    → INFO: msg {"logKey":"X","event.name":"x"}   ← still there
+  ignore: '…,event\\.name'  → INFO: msg {"logKey":"X"}                    ← hidden
+  ```
+
+  Found by a consumer who copied the `1.2.6` example verbatim, configured it, and saw the field
+  still on screen. The escaped form is now in the `PrettyViewOptions` JSDoc — where an editor's
+  autocomplete shows it, which is where someone actually is when writing the option — in the README,
+  and in the `1.2.6` example itself, which is corrected rather than left to keep teaching it.
+
+### Fixed
+
+- **An error's own properties now survive at every depth of the `cause` chain, not just at the top.**
+  `code`, `statusCode` and any domain field an application attaches were copied onto the error handed
+  to the log call and **dropped the moment that same error was wrapped as someone else's `cause`** —
+  which is what a `catch` in `main.ts` does routinely. Measured on the published `1.2.6`:
+
+  ```json
+  {
+    "type": "Error",
+    "message": "bootstrap failed",
+    "code": "EBOOT",
+    "cause": { "name": "Error", "message": "config invalid" }
+  }
+  ```
+
+  The inner error carried `code: "BYMAX_CONFIG_VALIDATION"` and an `issues` array holding one entry
+  per invalid variable. Both vanished. The reporting consumer framed the severity exactly right:
+  because `message` survives and their message is the full aggregated report, **the human stayed
+  served while the machine went blind** — the text an operator reads was intact, and the fields an
+  alert or a dashboard keys on were gone.
+
+  Nothing justified the asymmetry. The reason own properties are "part of the contract" at the top —
+  `pino.stdSerializers.err` copied them, so dropping them is a silent compatibility loss — is the
+  same reason one level down, and a wrapped error is the common case rather than the exotic one.
+  They still never shadow a field the serializer derives, and they still pass through the same
+  name-based redaction and size bound as any other serializer output.
+
+  Found by following up an asymmetry noticed while answering a consumer's question about how to pass
+  an error through the NestJS bridge — not by a bug report.
+
+### Changed
+
+- **The own-property copy lives in one place instead of two.** The `err` serializer read the raw
+  thrown value and walked its properties itself, duplicating what the sanitizer now does at every
+  node; it copies from the sanitized node instead. Same fields, one walk — and no second copy to
+  drift away from the first.
+
 ## [1.2.6] - 2026-08-15
 
 ### Added
@@ -30,7 +131,7 @@ heading here.
 
   ```ts
   new PrettyDevDestination({
-    view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+    view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event\\.name' }
   })
   ```
 
@@ -1130,7 +1231,8 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.2.6...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.2.7...HEAD
+[1.2.7]: https://github.com/bymaxone/nest-logger/compare/v1.2.6...v1.2.7
 [1.2.6]: https://github.com/bymaxone/nest-logger/compare/v1.2.5...v1.2.6
 [1.2.5]: https://github.com/bymaxone/nest-logger/compare/v1.2.4...v1.2.5
 [1.2.4]: https://github.com/bymaxone/nest-logger/compare/v1.2.3...v1.2.4

package/README.md

@@ -534,6 +534,32 @@ any other field. `AggregateError` members reach the entry as `err.errors`. There
 OpenTelemetry attribute for a cause chain, so these stay namespaced under `err` rather than
 inventing an `exception.cause` the spec does not define.
 
+**An error's own enumerable properties travel with it at every depth** — `code` on a Node system
+error, `statusCode` from an HTTP layer, whatever domain fields you attached — including on a nested
+`cause` and on each `AggregateError` member:
+
+```json
+{
+  "err": {
+    "type": "Error",
+    "message": "bootstrap failed",
+    "code": "EBOOT",
+    "cause": {
+      "name": "Error",
+      "message": "config invalid",
+      "code": "BYMAX_CONFIG_VALIDATION",
+      "issues": [{ "variable": "DATABASE_URL", "code": "invalid_url" }]
+    }
+  }
+}
+```
+
+This matters because `code` is usually the field you alert on. Until 1.2.7 those properties survived
+only on the error handed to the log call and were dropped the moment the same error was wrapped as
+someone else's `cause` — which is what a `catch` in `main.ts` does routinely. They never shadow a
+field the serializer derives, and they pass through the same name-based redaction and size bound as
+any other serializer output.
+
 An error's own enumerable properties (`code`, `statusCode`, domain fields) are carried through, as
 Pino's standard serializer did.
 
@@ -760,7 +786,7 @@ So the common accident — adding `new PrettyDevDestination()` without installin
 ```typescript
 // One line per entry, with the fields your project repeats on every line hidden.
 new PrettyDevDestination({
-  view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+  view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event\\.name' }
 })
 
 // Message only, with the context pulled back into the line.
@@ -780,6 +806,15 @@ new PrettyDevDestination({
 
 > **`hideObject` hides it everywhere.** In pretty mode there is no JSON copy behind the rendering, because `destinations` **replaces** stdout — so a field hidden here, `logKey` included, is not visible anywhere. That is what the option is for; `messageFormat` is how you pull a specific field back.
 
+> **A dot in `ignore` means "nested path", so a field name that CONTAINS a dot must escape it.** This library emits `event.name` as a literal top-level key, so the obvious spelling hides nothing at all — `pino-pretty` looks for an `event` object with a `name` inside, finds neither, and says nothing. Measured on one entry with only the option changing:
+>
+> ```
+> ignore: '…,event.name'    → INFO: msg {"logKey":"X","event.name":"x"}   ← still there
+> ignore: '…,event\\.name'  → INFO: msg {"logKey":"X"}                    ← hidden
+> ```
+>
+> In a TypeScript string literal that is `'event\\.name'` — one real backslash reaching `pino-pretty`. `service` and `deployment` need no escape; they really are nested objects. Reported by a consumer who copied the example above when it still had the unescaped form.
+
 The shape is exported as `PrettyViewOptions` when you want to build the view separately — it is this library's own interface, not a re-export of `pino-pretty`'s `PrettyOptions`, so type-checking without the optional peer installed still resolves.
 
 > **`destination` is not exposed, by design.** The library owns where entries go — a redirected stream would route around the fan-out and the last-resort rescue above. It is absent from the type and applied after your options are merged, so it cannot be overridden from untyped JavaScript either.

package/dist/server/index.cjs

@@ -232,6 +232,13 @@ function escapeControlCharacters(text) {
 var DEFAULT_MAX_CAUSE_DEPTH = 3;
 var MAX_AGGREGATE_ERRORS = 10;
 var CIRCULAR_SENTINEL = "[Circular]";
+var DERIVED_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "name",
+  "message",
+  "stack",
+  "cause",
+  "errors"
+]);
 function sanitizeError(err, options) {
   const maxCauseDepth = DEFAULT_MAX_CAUSE_DEPTH;
   return toSanitizedError(err, /* @__PURE__ */ new WeakSet(), 0, maxCauseDepth);
@@ -267,11 +274,23 @@ function toSanitizedError(value, seen, depth2, maxDepth) {
         result.errors.push(createWidthMarker(aggregated.length - MAX_AGGREGATE_ERRORS));
       }
     }
+    assignOwnErrorFields(result, value);
     return result;
   } catch {
     return { name: "SanitizeFailed", message: "Failed to sanitize the thrown value" };
   }
 }
+function assignOwnErrorFields(target, source) {
+  try {
+    const own = Array.isArray(source) ? {} : source;
+    for (const [key, value] of Object.entries(own)) {
+      if (!Object.hasOwn(target, key) && !DERIVED_ERROR_FIELDS.has(key)) {
+        Object.defineProperty(target, key, { value, enumerable: true });
+      }
+    }
+  } catch {
+  }
+}
 function toSanitizedChild(value, seen, depth2, maxDepth) {
   if (isObject(value) && seen.has(value)) {
     return CIRCULAR_SENTINEL;
@@ -1401,13 +1420,6 @@ function leafNameOf(path) {
   }
   return leaf;
 }
-var DERIVED_ERROR_FIELDS = /* @__PURE__ */ new Set([
-  "name",
-  "message",
-  "stack",
-  "cause",
-  "errors"
-]);
 function serializeErrorValue(value_) {
   const sanitized = sanitizeError(value_);
   const serialized = {
@@ -1424,18 +1436,7 @@ function serializeErrorValue(value_) {
   if (sanitized.errors !== void 0) {
     serialized["errors"] = sanitized.errors;
   }
-  try {
-    const source = (
-      // Stryker disable next-line ConditionalExpression: equivalent BY CONSTRUCTION, not untested — the never-throw catch below makes the mutant observationally identical: with the null check flipped to true, `Object.entries(null)` throws, the catch swallows it, and the emitted envelope is byte-for-byte the same. The guard stays because routing the ordinary null case through exception control flow would trade an explicit branch for a hidden one.
-      typeof value_ === "object" && value_ !== null && !Array.isArray(value_) ? value_ : {}
-    );
-    for (const [key, value] of Object.entries(source)) {
-      if (!Object.hasOwn(serialized, key) && !DERIVED_ERROR_FIELDS.has(key)) {
-        Reflect.set(serialized, key, value);
-      }
-    }
-  } catch {
-  }
+  assignOwnErrorFields(serialized, sanitized);
   return serialized;
 }
 function withSemconvException(record, format) {
@@ -1485,6 +1486,9 @@ function resolveNameRedactor(options) {
   if (options.redactStrategy !== "names") {
     return PASS_THROUGH;
   }
+  return buildNameRedactor(options);
+}
+function buildNameRedactor(options) {
   const names = [
     ...options.shouldDisableDefaultRedact ? [] : REDACT_COMMON_FIELDS,
     ...options.redactPaths.flatMap((path) => leafNameOf(path) ?? [])
@@ -1503,8 +1507,9 @@ function resolveRedactOption(options) {
 }
 function buildPinoInstance(options, logContext, destinations, health) {
   const maxBytes = options.maxEntrySizeBytes;
-  const redact = resolveNameRedactor(options);
-  const bound = (serializer) => createSizeBoundedSerializer((input) => redact(serializer(input)), maxBytes);
+  const redactRecord = resolveNameRedactor(options);
+  const redactSerialized = buildNameRedactor(options);
+  const bound = (serializer) => createSizeBoundedSerializer((input) => redactSerialized(serializer(input)), maxBytes);
   const serializers = {
     err: bound(serializeErrorValue),
     ...Object.fromEntries(
@@ -1541,14 +1546,17 @@ function buildPinoInstance(options, logContext, destinations, health) {
       // consumer's extra metadata instead of silently dropping it. Runs ONCE, at
       // logger construction — no per-entry cost. `true`: bindings are a record
       // root, iterated rather than serialized.
-      bindings: (bindings) => redact(bindings, true),
+      bindings: (bindings) => redactRecord(bindings, true),
       // The name-walk redactor runs here, on the merged record (mixin output +
       // the caller's object), which is exactly the surface a caller controls.
       // `base` and child bindings are NOT visible at this hook — they are
       // library-owned (`service`, the `@InjectLogger` context) and carry nothing
       // sensitive, which `pino-factory.spec.ts` pins.
       log: (record) => withSemconvException(
-        withEventName(redact(record, true), options.eventNameField),
+        withEventName(
+          redactRecord(record, true),
+          options.eventNameField
+        ),
         options.errorFormat
       )
     },

package/dist/server/index.d.cts

@@ -899,7 +899,7 @@ declare class DefaultStdoutDestination implements ILogDestination {
  *   // One line per entry, with the fields a project repeats on every line hidden.
  *   const view: PrettyViewOptions = {
  *     singleLine: true,
- *     ignore: 'pid,hostname,service,deployment,event.name'
+ *     ignore: 'pid,hostname,service,deployment,event\\.name'
  *   }
  */
 interface PrettyViewOptions {
@@ -914,6 +914,21 @@ interface PrettyViewOptions {
      * what a real sink receives is untouched. Extend rather than replace when the
      * goal is quieter output — the default already hides the noisiest fields.
      * Default: `'pid,hostname,service'`.
+     *
+     * **A dot means "nested path", so a field name CONTAINING a dot has to escape
+     * it.** This library emits `event.name` as a literal top-level key, so the
+     * obvious spelling silently hides nothing — `pino-pretty` looks for an `event`
+     * object with a `name` inside and finds neither. Measured on one entry, only
+     * the option changing:
+     *
+     * ```
+     * ignore: '…,event.name'    → INFO: msg {"logKey":"X","event.name":"x"}   ← still there
+     * ignore: '…,event\\.name'  → INFO: msg {"logKey":"X"}                    ← hidden
+     * ```
+     *
+     * In a TypeScript string literal that is `'event\\.name'` — one real backslash
+     * reaching `pino-pretty`. Nested objects (`service`, `deployment`) need no
+     * escape; they really are paths.
      */
     ignore?: string;
     /**
@@ -949,7 +964,7 @@ interface PrettyViewOptions {
  *
  *   // One line per entry, with this project's repeated fields hidden.
  *   new PrettyDevDestination({
- *     view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+ *     view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event\\.name' }
  *   })
  *
  *   // Message-only, with the context pulled back into the line.

package/dist/server/index.d.ts

@@ -899,7 +899,7 @@ declare class DefaultStdoutDestination implements ILogDestination {
  *   // One line per entry, with the fields a project repeats on every line hidden.
  *   const view: PrettyViewOptions = {
  *     singleLine: true,
- *     ignore: 'pid,hostname,service,deployment,event.name'
+ *     ignore: 'pid,hostname,service,deployment,event\\.name'
  *   }
  */
 interface PrettyViewOptions {
@@ -914,6 +914,21 @@ interface PrettyViewOptions {
      * what a real sink receives is untouched. Extend rather than replace when the
      * goal is quieter output — the default already hides the noisiest fields.
      * Default: `'pid,hostname,service'`.
+     *
+     * **A dot means "nested path", so a field name CONTAINING a dot has to escape
+     * it.** This library emits `event.name` as a literal top-level key, so the
+     * obvious spelling silently hides nothing — `pino-pretty` looks for an `event`
+     * object with a `name` inside and finds neither. Measured on one entry, only
+     * the option changing:
+     *
+     * ```
+     * ignore: '…,event.name'    → INFO: msg {"logKey":"X","event.name":"x"}   ← still there
+     * ignore: '…,event\\.name'  → INFO: msg {"logKey":"X"}                    ← hidden
+     * ```
+     *
+     * In a TypeScript string literal that is `'event\\.name'` — one real backslash
+     * reaching `pino-pretty`. Nested objects (`service`, `deployment`) need no
+     * escape; they really are paths.
      */
     ignore?: string;
     /**
@@ -949,7 +964,7 @@ interface PrettyViewOptions {
  *
  *   // One line per entry, with this project's repeated fields hidden.
  *   new PrettyDevDestination({
- *     view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+ *     view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event\\.name' }
  *   })
  *
  *   // Message-only, with the context pulled back into the line.

package/dist/server/index.mjs

@@ -229,6 +229,13 @@ function escapeControlCharacters(text) {
 var DEFAULT_MAX_CAUSE_DEPTH = 3;
 var MAX_AGGREGATE_ERRORS = 10;
 var CIRCULAR_SENTINEL = "[Circular]";
+var DERIVED_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "name",
+  "message",
+  "stack",
+  "cause",
+  "errors"
+]);
 function sanitizeError(err, options) {
   const maxCauseDepth = DEFAULT_MAX_CAUSE_DEPTH;
   return toSanitizedError(err, /* @__PURE__ */ new WeakSet(), 0, maxCauseDepth);
@@ -264,11 +271,23 @@ function toSanitizedError(value, seen, depth2, maxDepth) {
         result.errors.push(createWidthMarker(aggregated.length - MAX_AGGREGATE_ERRORS));
       }
     }
+    assignOwnErrorFields(result, value);
     return result;
   } catch {
     return { name: "SanitizeFailed", message: "Failed to sanitize the thrown value" };
   }
 }
+function assignOwnErrorFields(target, source) {
+  try {
+    const own = Array.isArray(source) ? {} : source;
+    for (const [key, value] of Object.entries(own)) {
+      if (!Object.hasOwn(target, key) && !DERIVED_ERROR_FIELDS.has(key)) {
+        Object.defineProperty(target, key, { value, enumerable: true });
+      }
+    }
+  } catch {
+  }
+}
 function toSanitizedChild(value, seen, depth2, maxDepth) {
   if (isObject(value) && seen.has(value)) {
     return CIRCULAR_SENTINEL;
@@ -1398,13 +1417,6 @@ function leafNameOf(path2) {
   }
   return leaf;
 }
-var DERIVED_ERROR_FIELDS = /* @__PURE__ */ new Set([
-  "name",
-  "message",
-  "stack",
-  "cause",
-  "errors"
-]);
 function serializeErrorValue(value_) {
   const sanitized = sanitizeError(value_);
   const serialized = {
@@ -1421,18 +1433,7 @@ function serializeErrorValue(value_) {
   if (sanitized.errors !== void 0) {
     serialized["errors"] = sanitized.errors;
   }
-  try {
-    const source = (
-      // Stryker disable next-line ConditionalExpression: equivalent BY CONSTRUCTION, not untested — the never-throw catch below makes the mutant observationally identical: with the null check flipped to true, `Object.entries(null)` throws, the catch swallows it, and the emitted envelope is byte-for-byte the same. The guard stays because routing the ordinary null case through exception control flow would trade an explicit branch for a hidden one.
-      typeof value_ === "object" && value_ !== null && !Array.isArray(value_) ? value_ : {}
-    );
-    for (const [key, value] of Object.entries(source)) {
-      if (!Object.hasOwn(serialized, key) && !DERIVED_ERROR_FIELDS.has(key)) {
-        Reflect.set(serialized, key, value);
-      }
-    }
-  } catch {
-  }
+  assignOwnErrorFields(serialized, sanitized);
   return serialized;
 }
 function withSemconvException(record, format) {
@@ -1482,6 +1483,9 @@ function resolveNameRedactor(options) {
   if (options.redactStrategy !== "names") {
     return PASS_THROUGH;
   }
+  return buildNameRedactor(options);
+}
+function buildNameRedactor(options) {
   const names = [
     ...options.shouldDisableDefaultRedact ? [] : REDACT_COMMON_FIELDS,
     ...options.redactPaths.flatMap((path2) => leafNameOf(path2) ?? [])
@@ -1500,8 +1504,9 @@ function resolveRedactOption(options) {
 }
 function buildPinoInstance(options, logContext, destinations, health) {
   const maxBytes = options.maxEntrySizeBytes;
-  const redact = resolveNameRedactor(options);
-  const bound = (serializer) => createSizeBoundedSerializer((input) => redact(serializer(input)), maxBytes);
+  const redactRecord = resolveNameRedactor(options);
+  const redactSerialized = buildNameRedactor(options);
+  const bound = (serializer) => createSizeBoundedSerializer((input) => redactSerialized(serializer(input)), maxBytes);
   const serializers = {
     err: bound(serializeErrorValue),
     ...Object.fromEntries(
@@ -1538,14 +1543,17 @@ function buildPinoInstance(options, logContext, destinations, health) {
       // consumer's extra metadata instead of silently dropping it. Runs ONCE, at
       // logger construction — no per-entry cost. `true`: bindings are a record
       // root, iterated rather than serialized.
-      bindings: (bindings) => redact(bindings, true),
+      bindings: (bindings) => redactRecord(bindings, true),
       // The name-walk redactor runs here, on the merged record (mixin output +
       // the caller's object), which is exactly the surface a caller controls.
       // `base` and child bindings are NOT visible at this hook — they are
       // library-owned (`service`, the `@InjectLogger` context) and carry nothing
       // sensitive, which `pino-factory.spec.ts` pins.
       log: (record) => withSemconvException(
-        withEventName(redact(record, true), options.eventNameField),
+        withEventName(
+          redactRecord(record, true),
+          options.eventNameField
+        ),
         options.errorFormat
       )
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",