@contrast/agent-bundle 5.39.1 → 5.41.0

package/node_modules/form-data/lib/form_data.js

@@ -8,6 +8,7 @@ var https = require('https');
 var parseUrl = require('url').parse;
 var fs = require('fs');
 var Stream = require('stream').Stream;
+var crypto = require('crypto');
 var mime = require('mime-types');
 var asynckit = require('asynckit');
 var setToStringTag = require('es-set-tostringtag');
@@ -345,12 +346,7 @@ FormData.prototype._generateBoundary = function () {
   // This generates a 50 character boundary similar to those used by Firefox.
 
   // They are optimized for boyer-moore parsing.
-  var boundary = '--------------------------';
-  for (var i = 0; i < 24; i++) {
-    boundary += Math.floor(Math.random() * 10).toString(16);
-  }
-
-  this._boundary = boundary;
+  this._boundary = '--------------------------' + crypto.randomBytes(12).toString('hex');
 };
 
 // Note: getLengthSync DOESN'T calculate streams length

package/node_modules/form-data/package.json

@@ -2,7 +2,7 @@
   "author": "Felix Geisendörfer <felix@debuggable.com> (http://debuggable.com/)",
   "name": "form-data",
   "description": "A library to create readable \"multipart/form-data\" streams. Can be used to submit forms and file uploads to other web applications.",
-  "version": "4.0.3",
+  "version": "4.0.4",
   "repository": {
     "type": "git",
     "url": "git://github.com/form-data/form-data.git"
@@ -28,10 +28,13 @@
     "files": "pkgfiles --sort=name",
     "get-version": "node -e \"console.log(require('./package.json').version)\"",
     "update-readme": "sed -i.bak 's/\\/master\\.svg/\\/v'$(npm --silent run get-version)'.svg/g' README.md",
-    "restore-readme": "mv README.md.bak README.md",
+    "postupdate-readme": "mv README.md.bak READ.ME.md.bak",
+    "restore-readme": "mv READ.ME.md.bak README.md",
     "prepublish": "not-in-publish || npm run prepublishOnly",
-    "prepublishOnly": "npm run update-readme",
-    "postpublish": "npm run restore-readme"
+    "prepack": "npm run update-readme",
+    "postpack": "npm run restore-readme",
+    "version": "auto-changelog && git add CHANGELOG.md",
+    "postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""
   },
   "engines": {
     "node": ">= 6"
@@ -44,7 +47,8 @@
     "mime-types": "^2.1.12"
   },
   "devDependencies": {
-    "@ljharb/eslint-config": "^21.1.1",
+    "@ljharb/eslint-config": "^21.2.0",
+    "auto-changelog": "^2.5.0",
     "browserify": "^13.3.0",
     "browserify-istanbul": "^2.0.0",
     "coveralls": "^3.1.1",
@@ -58,9 +62,21 @@
     "istanbul": "^0.4.5",
     "obake": "^0.1.2",
     "pkgfiles": "^2.3.2",
+    "pre-commit": "^1.2.2",
+    "predict-v8-randomness": "^1.0.35",
+    "puppeteer": "^1.20.0",
     "request": "~2.87.0",
     "rimraf": "^2.7.1",
+    "semver": "^6.3.1",
     "tape": "^5.9.0"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "auto-changelog": {
+    "output": "CHANGELOG.md",
+    "template": "keepachangelog",
+    "unreleased": false,
+    "commitLimit": false,
+    "backfillLimit": false,
+    "hideCredit": true
+  }
 }

package/node_modules/nan/.github/workflows/ci.yml

@@ -12,11 +12,17 @@ on:
 permissions:
   contents: read
 jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pre-commit/action@v3.0.1
+
   ci:
     strategy:
       fail-fast: false
-      matrix:  # TODO: Enable 23.x after nodejs/nan#979 or similar.
-        node-version: [22.x, 21.x, 20.x, 19.x, 18.x, 17.x, 16.x]
+      matrix:
+        node-version: [24.x, 23.x, 22.x, 21.x, 20.x, 19.x, 18.x, 17.x, 16.x]
         os: [windows-latest]
         include:
           - node-version: lts/*
@@ -29,14 +35,6 @@ jobs:
             os: ubuntu-24.04-arm  # Linux on arm64
           - node-version: lts/*
             os: windows-2025
-          - node-version: 14.x
-            os: windows-2019
-          - node-version: 12.x
-            os: windows-2019
-          - node-version: 10.x
-            os: windows-2019
-          - node-version: 8.x
-            os: windows-2019
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4

package/node_modules/nan/.pre-commit-config.yaml

@@ -0,0 +1,8 @@
+repos:
+  - repo: https://github.com/cpplint/cpplint
+    rev: 2.0.0
+    hooks:
+      - id: cpplint
+        args:
+          - --filter=-whitespace/indent_namespace,-whitespace/parens
+          - --linelength=88

package/node_modules/nan/CHANGELOG.md

@@ -1,6 +1,10 @@
 # NAN ChangeLog
 
-**Version 2.22.2: current Node 22.14.0, Node 0.12: 0.12.18, Node 0.10: 0.10.48, iojs: 3.3.1**
+**Version 2.23.0: current Node 24.4.0, Node 0.12: 0.12.18, Node 0.10: 0.10.48, iojs: 3.3.1**
+
+### 2.23.0 Jul 10 2025
+
+  - Feature:  Support Node 23 (#979) 59ab6d03d5d68554290ee9f34003cd90aa92c185
 
 ### 2.22.2 Feb 26 2025
 

package/node_modules/nan/README.md

@@ -1,9 +1,9 @@
 Native Abstractions for Node.js
 ===============================
 
-**A header file filled with macro and utility goodness for making add-on development for Node.js easier across versions 8, 10, 12, 14, 16, 17, 18, 19, 20, 21, and 22.**
+**A header file filled with macro and utility goodness for making add-on development for Node.js easier across versions 8, 10, 12, 14, 16, 17, 18, 19, 20, 21, 22, 23 and 24.**
 
-***Current version: 2.22.2***
+***Current version: 2.23.0***
 
 *(See [CHANGELOG.md](https://github.com/nodejs/nan/blob/master/CHANGELOG.md) for complete ChangeLog)*
 
@@ -31,10 +31,10 @@ This project also contains some helper utilities that make addon development a b
 
 ## Usage
 
-Simply add **NAN** as a dependency in the *package.json* of your Node addon:
+Simply add **NAN** as a dependency using a package manager like npm, yarn, or bun:
 
 ``` bash
-$ npm install --save nan
+$ npm install nan
 ```
 
 Pull in the path to **NAN** in your *binding.gyp* so that you can use `#include <nan.h>` in your *.cpp* files:

package/node_modules/nan/nan.h

@@ -13,7 +13,7 @@
  *
  * MIT License <https://github.com/nodejs/nan/blob/master/LICENSE.md>
  *
- * Version 2.22.2: current Node 22.14.0, Node 0.12: 0.12.18, Node 0.10: 0.10.48, iojs: 3.3.1
+ * Version 2.23.0: current Node 24.4.0, Node 0.12: 0.12.18, Node 0.10: 0.10.48, iojs: 3.3.1
  *
  * See https://github.com/nodejs/nan for the latest update to this file
  **********************************************************************************/
@@ -179,7 +179,7 @@ namespace Nan {
 
 //=== CallbackInfo =============================================================
 
-#include "nan_callbacks.h"  // NOLINT(build/include)
+#include "nan_callbacks.h"  // NOLINT(build/include_subdir)
 
 //==============================================================================
 
@@ -304,8 +304,8 @@ inline Maybe<T> Just(const T& t) {
 # include "nan_maybe_pre_43_inl.h"  // NOLINT(build/include)
 #endif
 
-#include "nan_converters.h"  // NOLINT(build/include)
-#include "nan_new.h"  // NOLINT(build/include)
+#include "nan_converters.h"  // NOLINT(build/include_subdir)
+#include "nan_new.h"  // NOLINT(build/include_subdir)
 
 #if NAUV_UVVERSION < 0x000b17
 #define NAUV_WORK_CB(func) \
@@ -2615,7 +2615,9 @@ NAN_DEPRECATED inline void SetAccessor(
     obj->SetInternalField(imp::kDataIndex, data);
   }
 
-#if defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 12 || (V8_MAJOR_VERSION == 12 && defined(V8_MINOR_VERSION) && V8_MINOR_VERSION >= 5))
+#if defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 12 \
+            || (V8_MAJOR_VERSION == 12 && defined(V8_MINOR_VERSION) \
+            && V8_MINOR_VERSION >= 5))
   tpl->SetNativeDataProperty(
 #else
   tpl->SetAccessor(
@@ -2667,7 +2669,9 @@ inline void SetAccessor(
     obj->SetInternalField(imp::kDataIndex, data);
   }
 
-#if defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 12 || (V8_MAJOR_VERSION == 12 && defined(V8_MINOR_VERSION) && V8_MINOR_VERSION >= 5))
+#if defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 12 \
+            || (V8_MAJOR_VERSION == 12 && defined(V8_MINOR_VERSION) \
+            && V8_MINOR_VERSION >= 5))
   tpl->SetNativeDataProperty(
 #else
   tpl->SetAccessor(
@@ -2934,15 +2938,15 @@ inline void SetCallAsFunctionHandler(
 
 //=== Weak Persistent Handling =================================================
 
-#include "nan_weak.h"  // NOLINT(build/include)
+#include "nan_weak.h"  // NOLINT(build/include_subdir)
 
 //=== ObjectWrap ===============================================================
 
-#include "nan_object_wrap.h"  // NOLINT(build/include)
+#include "nan_object_wrap.h"  // NOLINT(build/include_subdir)
 
 //=== HiddenValue/Private ======================================================
 
-#include "nan_private.h"  // NOLINT(build/include)
+#include "nan_private.h"  // NOLINT(build/include_subdir)
 
 //=== Export ==================================================================
 
@@ -3034,15 +3038,15 @@ MakeMaybe(MaybeMaybe<T> v) {
 
 //=== TypedArrayContents =======================================================
 
-#include "nan_typedarray_contents.h"  // NOLINT(build/include)
+#include "nan_typedarray_contents.h"  // NOLINT(build/include_subdir)
 
 //=== JSON =====================================================================
 
-#include "nan_json.h"  // NOLINT(build/include)
+#include "nan_json.h"  // NOLINT(build/include_subdir)
 
 //=== ScriptOrigin =============================================================
 
-#include "nan_scriptorigin.h"  // NOLINT(build/include)
+#include "nan_scriptorigin.h"  // NOLINT(build/include_subdir)
 
 }  // end of namespace Nan
 

package/node_modules/nan/nan_callbacks.h

@@ -13,6 +13,19 @@ template<typename T> class FunctionCallbackInfo;
 template<typename T> class PropertyCallbackInfo;
 template<typename T> class Global;
 
+#if defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 12 ||                     \
+  (V8_MAJOR_VERSION == 12 && defined(V8_MINOR_VERSION) && V8_MINOR_VERSION > 4))
+namespace Intercepted {
+  constexpr v8::Intercepted No() { return v8::Intercepted::kNo; }
+  constexpr v8::Intercepted Yes() { return v8::Intercepted::kYes; }
+};
+#else
+namespace Intercepted {
+  inline void No() {}
+  inline void Yes() {}
+};
+#endif
+
 typedef void(*FunctionCallback)(const FunctionCallbackInfo<v8::Value>&);
 typedef void(*GetterCallback)
     (v8::Local<v8::String>, const PropertyCallbackInfo<v8::Value>&);

package/node_modules/nan/nan_callbacks_12_inl.h

@@ -106,10 +106,24 @@ class FunctionCallbackInfo {
   }
 
 #if NODE_MAJOR_VERSION < 10
-  inline v8::Local<v8::Function> Callee() const { return info_.Callee(); }
+  NAN_DEPRECATED inline v8::Local<v8::Function> Callee() const {
+    return info_.Callee();
+  }
 #endif
   inline v8::Local<v8::Value> Data() const { return data_; }
-  inline v8::Local<v8::Object> Holder() const { return info_.Holder(); }
+  inline v8::Local<v8::Object> Holder() const {
+#if defined(V8_MAJOR_VERSION) &&                                               \
+    (V8_MAJOR_VERSION > 12 ||                                                  \
+     (V8_MAJOR_VERSION == 12 &&                                                \
+      (defined(V8_MINOR_VERSION) &&                                            \
+       (V8_MINOR_VERSION > 5 ||                                                \
+        (V8_MINOR_VERSION == 5 && defined(V8_BUILD_NUMBER) &&                  \
+         V8_BUILD_NUMBER >= 214)))))
+    return info_.This();
+#else
+    return info_.Holder();
+#endif
+  }
   inline bool IsConstructCall() const { return info_.IsConstructCall(); }
   inline int Length() const { return info_.Length(); }
   inline v8::Local<v8::Value> operator[](int i) const { return info_[i]; }

package/node_modules/nan/nan_callbacks_pre_12_inl.h

@@ -136,9 +136,13 @@ class FunctionCallbackInfo {
     return ReturnValue<T>(return_value_);
   }
 
-  inline v8::Local<v8::Function> Callee() const { return args_.Callee(); }
+  NAN_DEPRECATED inline v8::Local<v8::Function> Callee() const {
+    return args_.Callee();
+  }
   inline v8::Local<v8::Value> Data() const { return data_; }
-  inline v8::Local<v8::Object> Holder() const { return args_.Holder(); }
+  inline v8::Local<v8::Object> Holder() const {
+    return args_.Holder();
+  }
   inline bool IsConstructCall() const { return args_.IsConstructCall(); }
   inline int Length() const { return args_.Length(); }
   inline v8::Local<v8::Value> operator[](int i) const { return args_[i]; }

package/node_modules/nan/nan_maybe_43_inl.h

@@ -90,7 +90,7 @@ inline Maybe<bool> Set(
 }
 
 #if NODE_MODULE_VERSION < NODE_4_0_MODULE_VERSION
-#include "nan_define_own_property_helper.h"  // NOLINT(build/include)
+#include "nan_define_own_property_helper.h"  // NOLINT(build/include_subdir)
 #endif
 
 inline Maybe<bool> DefineOwnProperty(

package/node_modules/nan/nan_maybe_pre_43_inl.h

@@ -100,7 +100,7 @@ inline Maybe<bool> Set(
   return Just<bool>(obj->Set(index, value));
 }
 
-#include "nan_define_own_property_helper.h"  // NOLINT(build/include)
+#include "nan_define_own_property_helper.h"  // NOLINT(build/include_subdir)
 
 inline Maybe<bool> DefineOwnProperty(
     v8::Handle<v8::Object> obj

package/node_modules/nan/nan_scriptorigin.h

@@ -11,26 +11,28 @@
 
 class ScriptOrigin : public v8::ScriptOrigin {
  public:
-
-#if defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 12 ||                      \
-  (V8_MAJOR_VERSION == 12 && (defined(V8_MINOR_VERSION) && (V8_MINOR_VERSION > 6\
-      || (V8_MINOR_VERSION == 6 && defined(V8_BUILD_NUMBER)                     \
-          && V8_BUILD_NUMBER >= 175)))))
+#if defined(V8_MAJOR_VERSION) &&                                               \
+    (V8_MAJOR_VERSION > 12 ||                                                  \
+     (V8_MAJOR_VERSION == 12 &&                                                \
+      (defined(V8_MINOR_VERSION) &&                                            \
+       (V8_MINOR_VERSION > 6 ||                                                \
+        (V8_MINOR_VERSION == 6 && defined(V8_BUILD_NUMBER) &&                  \
+         V8_BUILD_NUMBER >= 175)))))
   explicit ScriptOrigin(v8::Local<v8::Value> name) :
       v8::ScriptOrigin(name) {}
 
   ScriptOrigin(v8::Local<v8::Value> name
              , v8::Local<v8::Integer> line) :
       v8::ScriptOrigin(name
-                   , To<int32_t>(line).FromMaybe(0)) {}
+                     , To<int32_t>(line).FromMaybe(0)) {}
 
   ScriptOrigin(v8::Local<v8::Value> name
              , v8::Local<v8::Integer> line
              , v8::Local<v8::Integer> column) :
       v8::ScriptOrigin(name
-                   , To<int32_t>(line).FromMaybe(0)
-                   , To<int32_t>(column).FromMaybe(0)) {}
-#elif defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 9 ||                      \
+                     , To<int32_t>(line).FromMaybe(0)
+                     , To<int32_t>(column).FromMaybe(0)) {}
+#elif defined(V8_MAJOR_VERSION) && (V8_MAJOR_VERSION > 9 ||                    \
   (V8_MAJOR_VERSION == 9 && (defined(V8_MINOR_VERSION) && (V8_MINOR_VERSION > 0\
       || (V8_MINOR_VERSION == 0 && defined(V8_BUILD_NUMBER)                    \
           && V8_BUILD_NUMBER >= 1)))))

package/node_modules/nan/nan_typedarray_contents.h

@@ -83,7 +83,7 @@ class TypedArrayContents {
  private:
   NAN_DISALLOW_ASSIGN_COPY_MOVE(TypedArrayContents)
 
-  //Disable heap allocation
+  // Disable heap allocation
   void *operator new(size_t size);
   void operator delete(void *, size_t) {
     abort();

package/node_modules/nan/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nan",
-  "version": "2.22.2",
-  "description": "Native Abstractions for Node.js: C++ header for Node 0.8 -> 22 compatibility",
+  "version": "2.23.0",
+  "description": "Native Abstractions for Node.js: C++ header for Node 0.8 -> 24 compatibility",
   "main": "include_dirs.js",
   "repository": {
     "type": "git",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent-bundle",
-  "version": "5.39.1",
+  "version": "5.41.0",
   "description": "Contrast Security Node.js Agent bundle with all dependencies included",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -26,7 +26,9 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent": "5.39.1"
+    "@contrast/agent": "5.41.0"
   },
-  "bundleDependencies": true
+  "bundleDependencies": [
+    "@contrast/agent"
+  ]
 }

package/node_modules/@contrast/agentify/lib/sources.js

@@ -1,94 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { EventEmitter } = require('events');
-const onFinished = require('on-finished');
-const { Event, primordials: { StringPrototypeToLowerCase } } = require('@contrast/common');
-
-module.exports = function(core) {
-  const {
-    messages,
-    instrumentation: { instrument },
-    scopes: { sources: sourcesStorage }
-  } = core;
-
-  const _hooks = new EventEmitter();
-
-  function aroundHook(serverType) {
-    return function around(next, data) {
-      const { args: [event, req, res] } = data;
-
-      if (event !== 'request') {
-        if (event === 'listening') {
-          // take a snapshot of Perf.all at this point. this will get logged
-          // at some point on the perf interval timer.
-          core.Perf.mark('listening');
-        }
-        return next();
-      }
-      // let's count requests.
-      core.Perf.requestCount += 1;
-
-      const store = {
-        sourceInfo: {
-          port: req.socket.address?.()?.port || 0,
-          protocol: serverType === 'http' ? 'http' : 'https',
-          serverType,
-          time: Date.now(),
-          method: StringPrototypeToLowerCase.call(req.method),
-        }
-      };
-
-      if (_hooks._events.onSource) {
-        _hooks.emit('onSource', {
-          // future: non-http sources will have their own type
-          sourceType: 'HTTP',
-          store,
-          incomingMessage: req,
-          serverResponse: res,
-        });
-      }
-
-      onFinished(res, (/* err, req */) => {
-        messages.emit(Event.RESPONSE_FINISH, store);
-      });
-
-      return sourcesStorage.run(store, next);
-    };
-  }
-
-  function install() {
-    ['http', 'https', 'spdy', 'http2'].forEach((moduleName) => {
-      instrument({
-        moduleName,
-        patchObjects: [{
-          name: 'Server.prototype',
-          methods: ['emit'],
-          patchType: 'sources',
-          around: aroundHook(moduleName)
-        }]
-      });
-    });
-  }
-  return core.sources = {
-    install,
-    addHook(name, handler) {
-      if (name === 'onSource') _hooks.on(name, handler);
-    },
-    aroundHook
-  };
-};

package/node_modules/@contrast/route-coverage/lib/install/http.js

@@ -1,44 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-'use strict';
-
-module.exports = function init(core) {
-  const { depHooks, patcher, routeCoverage } = core;
-
-  let handled;
-
-  return core.routeCoverage.http = {
-    install() {
-      [['http', '*'], ['https', '*'], ['spdy', '<5']].forEach(([name, version]) => {
-        depHooks.resolve({ name, version }, (_export) => {
-          if (!_export?.Server?.prototype) return;
-
-          patcher.patch(_export.Server.prototype, 'listen', {
-            name: `${name}.Server.prototype.listen`,
-            patchType: 'route-coverage',
-            post(data) {
-              data.result?.on('listening', () => {
-                if (!handled) {
-                  handled = true;
-                  routeCoverage.discoveryFinished();
-                }
-              });
-            }
-          });
-        });
-      });
-    }
-  };
-};

package/node_modules/@contrast/sec-obs/node_modules/@contrast/common/LICENSE

@@ -1,12 +0,0 @@
-Copyright: 2025 Contrast Security, Inc
-Contact: support@contrastsecurity.com
-License: Commercial
-
-NOTICE: This Software and the patented inventions embodied within may only be
-used as part of Contrast Security’s commercial offerings. Even though it is
-made available through public repositories, use of this Software is subject to
-the applicable End User Licensing Agreement found at
-https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-between Contrast Security and the End User. The Software may not be reverse
-engineered, modified, repackaged, sold, redistributed or otherwise used in a
-way not consistent with the End User License Agreement.