@contrast/agent-bundle 5.42.0 → 5.45.1

package/README.md

@@ -65,23 +65,14 @@ Notes:
 
 ### With end-of-life Node.js Versions
 
-When using the agent with end-of-life Node.js versions, use either the `--loader` or
-`--require` flag, depending on the version of Node.js and the module system used.
-
 Use the `--loader` flag for Node.js versions `>=16.17.0 <18.19.0`.
 
 ```sh
 node --loader @contrast/agent app-main.mjs [app arguments]
 ```
 
-Use the `--require` (`-r`) flag for Node.js versions `<16.17.0`.
-
-```sh
-node -r @contrast/agent app-main [app arguments]
-```
-
 Note:
-- `-r` will still work for Node.js versions that have no ESM modules or dependencies.
+- `--require` or `-r` will still work for Node.js versions that have no ESM modules or dependencies.
 
 ### Configuration
 

package/node_modules/@contrast/agent/README.md

@@ -65,23 +65,14 @@ Notes:
 
 ### With end-of-life Node.js Versions
 
-When using the agent with end-of-life Node.js versions, use either the `--loader` or
-`--require` flag, depending on the version of Node.js and the module system used.
-
 Use the `--loader` flag for Node.js versions `>=16.17.0 <18.19.0`.
 
 ```sh
 node --loader @contrast/agent app-main.mjs [app arguments]
 ```
 
-Use the `--require` (`-r`) flag for Node.js versions `<16.17.0`.
-
-```sh
-node -r @contrast/agent app-main [app arguments]
-```
-
 Note:
-- `-r` will still work for Node.js versions that have no ESM modules or dependencies.
+- `--require` or `-r` will still work for Node.js versions that have no ESM modules or dependencies.
 
 ### Configuration
 

package/node_modules/@contrast/agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "5.42.0",
+  "version": "5.45.1",
   "description": "Assess and Protect agents for Node.js",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -22,21 +22,21 @@
   "main": "./lib/index.js",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">=16.9.1 <17 || >=18.7.0 <19 || >=20.6.0 <21 || >= 22.5.1 <23"
+    "node": ">=18.7.0 <19 || >=20.6.0 <21 || >= 22.5.1 <23 || >= 24.0.1 <25"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agentify": "1.54.0",
-    "@contrast/architecture-components": "1.43.0",
-    "@contrast/assess": "1.60.0",
-    "@contrast/common": "1.35.0",
-    "@contrast/core": "1.55.0",
-    "@contrast/library-analysis": "1.45.0",
-    "@contrast/protect": "1.65.0",
-    "@contrast/route-coverage": "1.47.0",
-    "@contrast/sec-obs": "1.0.0-alpha.9",
-    "@contrast/telemetry": "1.30.0"
+    "@contrast/agentify": "1.57.0",
+    "@contrast/architecture-components": "1.45.1",
+    "@contrast/assess": "1.63.0",
+    "@contrast/common": "1.37.0",
+    "@contrast/core": "1.57.1",
+    "@contrast/library-analysis": "1.47.1",
+    "@contrast/protect": "1.68.0",
+    "@contrast/route-coverage": "1.49.1",
+    "@contrast/sec-obs": "1.1.1",
+    "@contrast/telemetry": "1.32.1"
   }
 }

package/node_modules/@contrast/agent-swc-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent-swc-plugin",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "SWC plugins Contrast Node agent",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
   "license": "SEE LICENSE IN LICENSE",
@@ -22,11 +22,11 @@
     "prepack": "cp target/wasm32-wasip1/release/*.wasm ."
   },
   "peerDependencies": {
-    "@swc/core": "^1.11.24"
+    "@swc/core": "^1.13.3"
   },
   "devDependencies": {
     "@swc/cli": "0.7.8",
-    "@swc/core": "^1.11.24",
+    "@swc/core": "^1.13.3",
     "@tsconfig/node16": "16.1.4",
     "benchmark": "2.1.4",
     "chai": "5.2.1",

package/node_modules/@contrast/agentify/lib/rewrite-hooks.js

@@ -26,8 +26,10 @@ const { rewriteIsDeadzoned } = require('@contrast/rewriter/lib/rewrite-is-deadzo
  * @returns {import('@contrast/common').Installable}
  */
 module.exports = function init(core) {
-  let js;
+  /** @type {Module.prototype["_compile"]} */
   let _compile;
+  /** @type {Module._extensions[".js"]} */
+  let js;
 
   core.rewriteHooks = {
     install() {
@@ -49,9 +51,7 @@ module.exports = function init(core) {
         /** @type {import('@contrast/rewriter').RewriteOpts} */
         const options = {
           filename,
-          isModule: false,
           inject: true,
-          wrap: true,
           minify: true,
         };
 

package/node_modules/@contrast/agentify/lib/utils.js

@@ -18,13 +18,17 @@
 const path = require('path');
 const process = require('process');
 const semver = require('semver');
-
 const {
   engines: {
     node: nodeEngines,
   }
 } = require('../package.json');
 
+const UNSUPPORTED_FLAGS = [
+  '--experimental',
+  '--permission',
+];
+
 const { primordials: { StringPrototypeSlice, StringPrototypeSplit, StringPrototypeTrim } } = require('@contrast/common');
 
 /**
@@ -33,7 +37,7 @@ const { primordials: { StringPrototypeSlice, StringPrototypeSplit, StringPrototy
  * @param {string} core.nodeEngines
  */
 function preStartupValidation(core) {
-  assertNoExperimentalFeatureFlags();
+  assertNoUnsupportedFlags();
   assertSupportedNodeVersion(core.nodeEngines || nodeEngines);
   assertSupportedPreloadUsage();
 }
@@ -61,15 +65,17 @@ function assertSupportedNodeVersion(engines) {
  * Checks that no experimental feature flags are used.
  * @throws {Error}
  */
-function assertNoExperimentalFeatureFlags() {
+function assertNoUnsupportedFlags() {
   const {
     execArgv,
     env: { NODE_OPTIONS },
   } = process;
 
-  if (execArgv.some(arg => arg.includes('--experimental')) || NODE_OPTIONS?.includes('--experimental')) {
-    const msg = 'Contrast Agent does not support experimental features.';
-    throw new Error(msg);
+  for (const pattern of UNSUPPORTED_FLAGS) {
+    if (execArgv.some(arg => arg.includes(pattern)) || NODE_OPTIONS?.includes(pattern)) {
+      const msg = `Contrast Agent does not support flags matching \`${pattern}\`.`;
+      throw new Error(msg);
+    }
   }
 }
 
@@ -168,6 +174,6 @@ module.exports = {
   assertValidOpts,
   assertSupportedNodeVersion,
   assertSupportedPreloadUsage,
-  assertNoExperimentalFeatureFlags,
+  assertNoUnsupportedFlags,
   preStartupValidation,
 };

package/node_modules/@contrast/agentify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agentify",
-  "version": "1.54.0",
+  "version": "1.57.0",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,28 +14,28 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
-    "@contrast/core": "1.55.0",
-    "@contrast/deadzones": "1.27.0",
-    "@contrast/dep-hooks": "1.24.0",
-    "@contrast/esm-hooks": "2.29.0",
+    "@contrast/common": "1.37.0",
+    "@contrast/config": "1.52.1",
+    "@contrast/core": "1.57.1",
+    "@contrast/deadzones": "1.29.1",
+    "@contrast/dep-hooks": "1.26.1",
+    "@contrast/esm-hooks": "2.32.0",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/instrumentation": "1.34.0",
-    "@contrast/logger": "1.28.0",
-    "@contrast/metrics": "1.32.0",
-    "@contrast/patcher": "1.27.0",
-    "@contrast/perf": "1.3.1",
-    "@contrast/reporter": "1.53.0",
-    "@contrast/rewriter": "1.31.0",
-    "@contrast/scopes": "1.25.0",
-    "@contrast/sources": "1.1.0",
+    "@contrast/instrumentation": "1.36.1",
+    "@contrast/logger": "1.30.1",
+    "@contrast/metrics": "1.34.1",
+    "@contrast/patcher": "1.29.1",
+    "@contrast/perf": "1.4.0",
+    "@contrast/reporter": "1.55.1",
+    "@contrast/rewriter": "1.34.0",
+    "@contrast/scopes": "1.27.1",
+    "@contrast/sources": "1.3.1",
     "on-finished": "^2.4.1",
     "semver": "^7.6.0"
   }

package/node_modules/@contrast/architecture-components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/architecture-components",
-  "version": "1.43.0",
+  "version": "1.45.1",
   "description": "Detects external systems being connected to by applications.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,15 +14,15 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.35.0",
-    "@contrast/dep-hooks": "1.24.0",
-    "@contrast/logger": "1.28.0",
-    "@contrast/patcher": "1.27.0"
+    "@contrast/common": "1.37.0",
+    "@contrast/dep-hooks": "1.26.1",
+    "@contrast/logger": "1.30.1",
+    "@contrast/patcher": "1.29.1"
   }
 }

package/node_modules/@contrast/assess/lib/dataflow/propagation/install/ejs/template.js

@@ -37,7 +37,7 @@ module.exports = function (core) {
   } = core;
 
   /** @type {import('@contrast/rewriter').RewriteOpts} */
-  const REWRITE_OPTS = { isModule: false, inject: false, wrap: false, minify: false };
+  const REWRITE_OPTS = { inject: false, minify: false };
   const WRAPPER_PREFIX = ArrayPrototypeJoin.call([
     'function tempWrapper() {',
     'function __append(s) { if (s !== undefined && s !== null) __output += s }'

package/node_modules/@contrast/assess/lib/dataflow/propagation/install/pug/index.js

@@ -17,7 +17,7 @@
 const { patchType } = require('../../common');
 
 /** @type {import('@contrast/rewriter').RewriteOpts} */
-const REWRITE_OPTS = { isModule: false, inject: false, wrap: false, minify: false };
+const REWRITE_OPTS = { inject: false, minify: false };
 
 module.exports = function (core) {
   const store = { lock: true, name: 'assess:propagators:pug-compile' };

package/node_modules/@contrast/assess/lib/dataflow/sinks/install/http/server-response.js

@@ -77,7 +77,7 @@ module.exports = function(core) {
   ];
 
   const preHook = (moduleName, responseName, method) => ({ args, obj: response, result, hooked, orig }) => {
-    const methodName = `${responseName + (moduleName !== 'spdy' ? '.prototype' : '')}.${method}`;
+    const methodName = `${`${responseName}.prototype`}.${method}`;
     const name = `${moduleName}.${methodName}`;
     const sourceContext = getSinkContext(ruleId);
     if (!sourceContext) return;
@@ -91,7 +91,6 @@ module.exports = function(core) {
     const { contentType } = sourceContext.responseData;
     if (contentType && isSafeContentType(contentType)) return;
 
-    if (moduleName === 'spdy') response.spdyStream.once('finish', () => response.emit('finish'));
     if (isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
       const event = createSinkEvent({
         args: [{
@@ -175,16 +174,6 @@ module.exports = function(core) {
         });
       }
     });
-    depHooks.resolve({ name: 'spdy', version: '<5', file: 'lib/spdy/response.js' }, (response) => {
-      {
-        const method = 'end';
-        patcher.patch(response, method, {
-          name: 'spdy.response.end',
-          patchType,
-          pre: preHook('spdy', 'response', method),
-        });
-      }
-    });
   };
 
   return http;

package/node_modules/@contrast/assess/lib/dataflow/sinks/install/restify.js

@@ -113,7 +113,7 @@ module.exports = function(core) {
     install() {
       // restify adds functionality to the built-in response via this patch function.
       // once it returns the request, it'll have been decorated with redirect() method.
-      depHooks.resolve({ name: 'restify', version: '<12', file: 'lib/response.js' }, (responsePatch) => patcher.patch(responsePatch, {
+      depHooks.resolve({ name: 'restify', version: '>=10 <12', file: 'lib/response.js' }, (responsePatch) => patcher.patch(responsePatch, {
         name: 'restify.response.patch',
         patchType,
         post(data) {

package/node_modules/@contrast/assess/lib/dataflow/sources/install/http.js

@@ -196,7 +196,7 @@ module.exports = function (core) {
   }
 
   function install() {
-    ['http', 'https', 'spdy', 'http2'].forEach((moduleName) => {
+    ['http', 'https', 'http2'].forEach((moduleName) => {
       instrument({
         moduleName,
         patchObjects: [{

package/node_modules/@contrast/assess/lib/dataflow/tracker.js

@@ -65,7 +65,7 @@ module.exports = function tracker(core) {
 
       if (distringuish.getProperties(value)) {
         const err = new Error();
-        logger.error({ err, value }, 'tracker.track called with a string value that is already tracked');
+        logger.debug({ err, value }, 'tracker.track called with a string value that is already tracked');
         return { extern: null };
       }
 

package/node_modules/@contrast/assess/lib/get-source-context.js

@@ -101,7 +101,7 @@ function factory(core) {
       // that the caller previously logged, we generate a stack trace to
       // capture that information.
       const err = new Error('No source context found');
-      core.logger.warn({ err }, 'assess running outside of request scope');
+      core.logger.debug({ err }, 'assess running outside of request scope');
       return null;
     }
 

package/node_modules/@contrast/assess/lib/response-scanning/install/http.js

@@ -146,18 +146,6 @@ module.exports = function(core) {
         });
       }
     });
-
-    depHooks.resolve({ name: 'spdy', version: '<5', file: 'lib/spdy/response.js' }, (response) => {
-      patcher.patch(response, 'end', {
-        name: 'spdy.response.end',
-        patchType: 'test',
-        post(data) {
-          const sourceContext = getSourceContext();
-          if (!sourceContext) return;
-          endHookChecks(sourceContext, data.obj.getHeaders?.(), StringPrototypeToLowerCase.call(data.args[0] || ''));
-        }
-      });
-    });
   };
 
   return http;

package/node_modules/@contrast/assess/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.60.0",
+  "version": "1.63.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,24 +14,24 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
-    "@contrast/core": "1.55.0",
-    "@contrast/dep-hooks": "1.24.0",
-    "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.34.0",
-    "@contrast/logger": "1.28.0",
-    "@contrast/patcher": "1.27.0",
-    "@contrast/rewriter": "1.31.0",
-    "@contrast/route-coverage": "1.47.0",
-    "@contrast/scopes": "1.25.0",
-    "@contrast/sources": "1.1.0",
+    "@contrast/common": "1.37.0",
+    "@contrast/config": "1.52.1",
+    "@contrast/core": "1.57.1",
+    "@contrast/dep-hooks": "1.26.1",
+    "@contrast/distringuish": "^6.0.2",
+    "@contrast/instrumentation": "1.36.1",
+    "@contrast/logger": "1.30.1",
+    "@contrast/patcher": "1.29.1",
+    "@contrast/rewriter": "1.34.0",
+    "@contrast/route-coverage": "1.49.1",
+    "@contrast/scopes": "1.27.1",
+    "@contrast/sources": "1.3.1",
     "semver": "^7.6.0"
   }
 }

package/node_modules/@contrast/code-events/binding.gyp

@@ -31,7 +31,7 @@
           "OTHER_CFLAGS": [
             "-arch x86_64",
             "-arch arm64",
-            "-std=c++17",
+            "-std=c++20",
             "-stdlib=libc++",
             "-Wall"
           ],

package/node_modules/@contrast/code-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/code-events",
-  "version": "3.1.0",
+  "version": "4.0.2",
   "description": "Listen for v8 CodeEvents and make them available to JavaScript",
   "main": "index.js",
   "types": "index.d.ts",
@@ -22,7 +22,7 @@
     "install": "node-gyp-build",
     "prepare": "husky install",
     "prebuild": "npm run clean",
-    "build": "prebuildify -t 16.9.1 -t 18.7.0 -t 20.6.0 -t 22.2.0 --strip --napi false",
+    "build": "prebuildify -t 18.7.0 -t 20.6.0 -t 22.2.0 -t 24.0.1 --strip --napi false",
     "build:darwin": "npm run build -- --arch x64+arm64",
     "build:win32": "npm run build",
     "clean": "rimraf build/ coverage/ prebuilds/",
@@ -32,10 +32,16 @@
   },
   "keywords": [],
   "engines": {
-    "node": ">=16.9.1"
+    "node": ">=18.7.0"
   },
   "dependencies": {
-    "node-gyp-build": "^4.8.1"
+    "nan": "^2.23.0",
+    "node-abi": "^4.12.0",
+    "node-addon-api": "^8.5.0",
+    "node-gyp-build": "^4.8.4"
+  },
+  "overrides": {
+    "node-abi": "^4.12.0"
   },
   "devDependencies": {
     "@contrast/eslint-config": "^3.2.0",
@@ -43,14 +49,10 @@
     "@octokit/rest": "^20.0.1",
     "c8": "^8.0.1",
     "chai": "^4.3.7",
-    "fast-xml-parser": "^4.3.3",
     "husky": "^8.0.3",
     "lint-staged": "^13.2.3",
     "mocha": "^10.2.0",
-    "nan": "^2.19.0",
-    "node-abi": "^3.65.0",
-    "node-addon-api": "^7.1.0",
-    "node-gyp": "10.1.0",
+    "node-gyp": "^11.2.0",
     "prebuildify": "^6.0.1",
     "rimraf": "^5.0.1",
     "semver": "^7.5.4",

package/node_modules/@contrast/common/lib/constants.d.ts

@@ -10,7 +10,7 @@ export declare enum Event {
     ASSESS_CRYPTO_ANALYSIS_FINDING = "assess-crypto-analysis-finding",
     LIBRARY = "library",
     LIBRARY_USAGE = "library-usage",
-    PROTECT = "protect",
+    PROTECT_FINDING = "protect-finding",
     ROUTE_COVERAGE_OBSERVATION = "route-coverage-observation",
     SERVER_SETTINGS_UPDATE = "server-settings-update",// UI remote settings updates
     UNINSTALL = "uninstall",// disable all components/features

package/node_modules/@contrast/common/lib/constants.js

@@ -30,7 +30,7 @@ var Event;
     Event["ASSESS_CRYPTO_ANALYSIS_FINDING"] = "assess-crypto-analysis-finding";
     Event["LIBRARY"] = "library";
     Event["LIBRARY_USAGE"] = "library-usage";
-    Event["PROTECT"] = "protect";
+    Event["PROTECT_FINDING"] = "protect-finding";
     Event["ROUTE_COVERAGE_OBSERVATION"] = "route-coverage-observation";
     // state changes
     Event["SERVER_SETTINGS_UPDATE"] = "server-settings-update";