@contrast/agent-bundle 5.45.1 → 5.47.0

package/node_modules/@contrast/sources/lib/index.test.js

@@ -8,6 +8,38 @@ const mocks = require('@contrast/test/mocks');
 const proxyquire = require('proxyquire');
 
 describe('agentify sources', function () {
+  let core, api, ServerMock, reqMock, resMock, onFinishedMock;
+
+  beforeEach(function () {
+    ({ core } = initProtectFixture());
+    ServerMock = function ServerMock() {
+      this.e = new EventEmitter();
+    };
+    ServerMock.prototype.emit = function (...args) {
+      this.e.emit(...args);
+    };
+    ServerMock.prototype.on = function (...args) {
+      this.e.on(...args);
+    };
+    api = {
+      Server: ServerMock,
+      createServer() {
+        return new ServerMock();
+      },
+      createSecureServer() {
+        return new ServerMock();
+      }
+    };
+    reqMock = mocks.incomingMessage();
+    // resMock = new EventEmitter();
+    onFinishedMock = sinon.stub();
+
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'http' })).yields(api);
+    proxyquire('.', {
+      'on-finished': onFinishedMock,
+    })(core).install();
+  });
+
   [
     {
       name: 'http',
@@ -24,41 +56,9 @@ describe('agentify sources', function () {
         protocol: 'https',
         serverType: 'https',
       },
-    }
+    },
   ].forEach(({ name, method, expected }) => {
     describe(`${name} sources using ${method || 'Server'}()`, function () {
-      let core, api, ServerMock, reqMock, resMock, onFinishedMock;
-
-      beforeEach(function () {
-        ({ core } = initProtectFixture());
-        ServerMock = function ServerMock() {
-          this.e = new EventEmitter();
-        };
-        ServerMock.prototype.emit = function (...args) {
-          this.e.emit(...args);
-        };
-        ServerMock.prototype.on = function (...args) {
-          this.e.on(...args);
-        };
-        api = {
-          Server: ServerMock,
-          createServer() {
-            return new ServerMock();
-          },
-          createSecureServer() {
-            return new ServerMock();
-          }
-        };
-        reqMock = mocks.incomingMessage();
-        // resMock = new EventEmitter();
-        onFinishedMock = sinon.stub();
-
-        core.depHooks.resolve.withArgs(sinon.match({ name: 'http' })).yields(api);
-        proxyquire('.', {
-          'on-finished': onFinishedMock,
-        })(core).install();
-      });
-
       it('"request" events run in scope with correct sourceInfo', function () {
         const server = method ? api[method]() : new ServerMock();
         let store;
@@ -88,7 +88,52 @@ describe('agentify sources', function () {
 
         server.emit('foo', reqMock, resMock);
         expect(store).to.be.undefined;
+        expect(onFinishedMock).not.to.have.been.called;
       });
     });
   });
+
+  it('"upgrade" events run in scope with correct sourceInfo', function () {
+    const server = new ServerMock();
+    const socketMock = new EventEmitter();
+    let store;
+    let socketEventStore;
+
+    reqMock.rawHeaders.push('upgrade', 'websocket');
+
+    server.on('upgrade', function () {
+      store = core.scopes.sources.getStore();
+    });
+
+    server.emit('upgrade', reqMock, socketMock);
+
+    expect(store.sourceInfo).to.deep.include({
+      port: 8080,
+      protocol: 'http',
+      serverType: 'http',
+    });
+
+    socketMock.on('some-message', function() {
+      socketEventStore = core.scopes.sources.getStore();
+    });
+    socketMock.emit('some-message');
+
+    expect(store).to.equal(socketEventStore);
+  });
+
+  it('"upgrade" events do not run in scope if not "websocket"', function () {
+    const server = new ServerMock();
+    const socketMock = new EventEmitter();
+    let store;
+
+    reqMock.rawHeaders.push('upgrade', 'h2c');
+
+    server.on('upgrade', function () {
+      store = core.scopes.sources.getStore();
+    });
+
+    server.emit('upgrade', reqMock, socketMock);
+
+    expect(store).to.be.undefined;
+  });
 });

package/node_modules/@contrast/sources/lib/source-info.js

@@ -53,7 +53,7 @@ class HttpSourceInfo {
     this.httpVersion = raw.httpVersion;
     this.ip = raw.socket.remoteAddress ? StringPrototypeReplace.call(raw.socket.remoteAddress, /::ffff:/, '') : undefined;
     this.port = raw.socket.address?.()?.port || 0;
-    this.protocol = serverType == 'http' ? 'http' : 'https'; // todo
+    this.protocol = serverType == 'http' ? 'http' : 'https';
     this.serverType = serverType;
     this.time = Date.now();
     this.method = StringPrototypeToLowerCase.call(raw.method);
@@ -62,20 +62,11 @@ class HttpSourceInfo {
     for (let i = 0; i < raw.rawHeaders.length; i += 2) {
       const iNext = i + 1;
       const headerName = StringPrototypeToLowerCase.call(raw.rawHeaders[i]);
-
       headerName == 'content-type' && (this.contentType = raw.rawHeaders[iNext]);
-
       this.rawHeaders[i] = headerName;
       this.rawHeaders[iNext] = headerName == 'content-type' ?
         StringPrototypeToLowerCase.call(raw.rawHeaders[iNext]) :
         raw.rawHeaders[iNext];
-
-      if (
-        headerName == 'upgrade' &&
-        StringPrototypeToLowerCase.call(this.rawHeaders[iNext]) == 'websocket'
-      ) {
-        this.protocol = 'ws';
-      }
     }
 
     const idx = raw.url.indexOf('?');

package/node_modules/@contrast/sources/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/sources",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Instruments to have incoming messages run in async-local request scope.",
   "main": "lib/index.js",
   "scripts": {
@@ -9,8 +9,8 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/core": "1.57.1",
+    "@contrast/common": "1.38.0",
+    "@contrast/core": "1.59.0",
     "on-finished": "^2.4.1"
   }
 }

package/node_modules/@contrast/telemetry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/telemetry",
-  "version": "1.32.1",
+  "version": "1.34.0",
   "description": "Telemetry reporting for the Contrast Node.js agent.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -19,10 +19,10 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/config": "1.52.1",
-    "@contrast/core": "1.57.1",
-    "@contrast/logger": "1.30.1",
+    "@contrast/common": "1.38.0",
+    "@contrast/config": "1.54.0",
+    "@contrast/core": "1.59.0",
+    "@contrast/logger": "1.32.0",
     "axios": "^1.12.2",
     "getmac": "^6.3.0"
   }

package/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Thu, 18 Sep 2025 00:04:03 GMT
+ * Last updated: Tue, 28 Oct 2025 17:37:26 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/node/assert/strict.d.ts

@@ -1,8 +1,111 @@
+/**
+ * In strict assertion mode, non-strict methods behave like their corresponding
+ * strict methods. For example, `assert.deepEqual()` will behave like
+ * `assert.deepStrictEqual()`.
+ *
+ * In strict assertion mode, error messages for objects display a diff. In legacy
+ * assertion mode, error messages for objects display the objects, often truncated.
+ *
+ * To use strict assertion mode:
+ *
+ * ```js
+ * import { strict as assert } from 'node:assert';
+ * ```
+ *
+ * ```js
+ * import assert from 'node:assert/strict';
+ * ```
+ *
+ * Example error diff:
+ *
+ * ```js
+ * import { strict as assert } from 'node:assert';
+ *
+ * assert.deepEqual([[[1, 2, 3]], 4, 5], [[[1, 2, '3']], 4, 5]);
+ * // AssertionError: Expected inputs to be strictly deep-equal:
+ * // + actual - expected ... Lines skipped
+ * //
+ * //   [
+ * //     [
+ * // ...
+ * //       2,
+ * // +     3
+ * // -     '3'
+ * //     ],
+ * // ...
+ * //     5
+ * //   ]
+ * ```
+ *
+ * To deactivate the colors, use the `NO_COLOR` or `NODE_DISABLE_COLORS`
+ * environment variables. This will also deactivate the colors in the REPL. For
+ * more on color support in terminal environments, read the tty
+ * [`getColorDepth()`](https://nodejs.org/docs/latest-v24.x/api/tty.html#writestreamgetcolordepthenv) documentation.
+ * @since v15.0.0
+ * @see [source](https://github.com/nodejs/node/blob/v24.x/lib/assert/strict.js)
+ */
 declare module "assert/strict" {
-    import { strict } from "node:assert";
+    import {
+        Assert,
+        AssertionError,
+        AssertionErrorOptions,
+        AssertOptions,
+        AssertPredicate,
+        AssertStrict,
+        CallTracker,
+        CallTrackerCall,
+        CallTrackerReportInformation,
+        deepStrictEqual,
+        doesNotMatch,
+        doesNotReject,
+        doesNotThrow,
+        fail,
+        ifError,
+        match,
+        notDeepStrictEqual,
+        notStrictEqual,
+        ok,
+        partialDeepStrictEqual,
+        rejects,
+        strictEqual,
+        throws,
+    } from "node:assert";
+    function strict(value: unknown, message?: string | Error): asserts value;
+    namespace strict {
+        export {
+            Assert,
+            AssertionError,
+            AssertionErrorOptions,
+            AssertOptions,
+            AssertPredicate,
+            AssertStrict,
+            CallTracker,
+            CallTrackerCall,
+            CallTrackerReportInformation,
+            deepStrictEqual,
+            deepStrictEqual as deepEqual,
+            doesNotMatch,
+            doesNotReject,
+            doesNotThrow,
+            fail,
+            ifError,
+            match,
+            notDeepStrictEqual,
+            notDeepStrictEqual as notDeepEqual,
+            notStrictEqual,
+            notStrictEqual as notEqual,
+            ok,
+            partialDeepStrictEqual,
+            rejects,
+            strict,
+            strictEqual,
+            strictEqual as equal,
+            throws,
+        };
+    }
     export = strict;
 }
 declare module "node:assert/strict" {
-    import { strict } from "node:assert";
+    import strict = require("assert/strict");
     export = strict;
 }

package/node_modules/@types/node/assert.d.ts

@@ -4,17 +4,163 @@
  * @see [source](https://github.com/nodejs/node/blob/v24.x/lib/assert.js)
  */
 declare module "assert" {
+    import strict = require("assert/strict");
     /**
-     * An alias of {@link ok}.
+     * An alias of {@link assert.ok}.
      * @since v0.5.9
      * @param value The input that is checked for being truthy.
      */
     function assert(value: unknown, message?: string | Error): asserts value;
+    const kOptions: unique symbol;
     namespace assert {
+        type AssertMethodNames =
+            | "deepEqual"
+            | "deepStrictEqual"
+            | "doesNotMatch"
+            | "doesNotReject"
+            | "doesNotThrow"
+            | "equal"
+            | "fail"
+            | "ifError"
+            | "match"
+            | "notDeepEqual"
+            | "notDeepStrictEqual"
+            | "notEqual"
+            | "notStrictEqual"
+            | "ok"
+            | "partialDeepStrictEqual"
+            | "rejects"
+            | "strictEqual"
+            | "throws";
+        interface AssertOptions {
+            /**
+             * If set to `'full'`, shows the full diff in assertion errors.
+             * @default 'simple'
+             */
+            diff?: "simple" | "full" | undefined;
+            /**
+             * If set to `true`, non-strict methods behave like their
+             * corresponding strict methods.
+             * @default true
+             */
+            strict?: boolean | undefined;
+            /**
+             * If set to `true`, skips prototype and constructor
+             * comparison in deep equality checks.
+             * @since v24.9.0
+             * @default false
+             */
+            skipPrototype?: boolean | undefined;
+        }
+        interface Assert extends Pick<typeof assert, AssertMethodNames> {
+            readonly [kOptions]: AssertOptions & { strict: false };
+        }
+        interface AssertStrict extends Pick<typeof strict, AssertMethodNames> {
+            readonly [kOptions]: AssertOptions & { strict: true };
+        }
+        /**
+         * The `Assert` class allows creating independent assertion instances with custom options.
+         * @since v24.6.0
+         */
+        var Assert: {
+            /**
+             * Creates a new assertion instance. The `diff` option controls the verbosity of diffs in assertion error messages.
+             *
+             * ```js
+             * const { Assert } = require('node:assert');
+             * const assertInstance = new Assert({ diff: 'full' });
+             * assertInstance.deepStrictEqual({ a: 1 }, { a: 2 });
+             * // Shows a full diff in the error message.
+             * ```
+             *
+             * **Important**: When destructuring assertion methods from an `Assert` instance,
+             * the methods lose their connection to the instance's configuration options (such
+             * as `diff`, `strict`, and `skipPrototype` settings).
+             * The destructured methods will fall back to default behavior instead.
+             *
+             * ```js
+             * const myAssert = new Assert({ diff: 'full' });
+             *
+             * // This works as expected - uses 'full' diff
+             * myAssert.strictEqual({ a: 1 }, { b: { c: 1 } });
+             *
+             * // This loses the 'full' diff setting - falls back to default 'simple' diff
+             * const { strictEqual } = myAssert;
+             * strictEqual({ a: 1 }, { b: { c: 1 } });
+             * ```
+             *
+             * The `skipPrototype` option affects all deep equality methods:
+             *
+             * ```js
+             * class Foo {
+             *   constructor(a) {
+             *     this.a = a;
+             *   }
+             * }
+             *
+             * class Bar {
+             *   constructor(a) {
+             *     this.a = a;
+             *   }
+             * }
+             *
+             * const foo = new Foo(1);
+             * const bar = new Bar(1);
+             *
+             * // Default behavior - fails due to different constructors
+             * const assert1 = new Assert();
+             * assert1.deepStrictEqual(foo, bar); // AssertionError
+             *
+             * // Skip prototype comparison - passes if properties are equal
+             * const assert2 = new Assert({ skipPrototype: true });
+             * assert2.deepStrictEqual(foo, bar); // OK
+             * ```
+             *
+             * When destructured, methods lose access to the instance's `this` context and revert to default assertion behavior
+             * (diff: 'simple', non-strict mode).
+             * To maintain custom options when using destructured methods, avoid
+             * destructuring and call methods directly on the instance.
+             * @since v24.6.0
+             */
+            new(
+                options?: AssertOptions & { strict?: true | undefined },
+            ): AssertStrict;
+            new(
+                options: AssertOptions,
+            ): Assert;
+        };
+        interface AssertionErrorOptions {
+            /**
+             * If provided, the error message is set to this value.
+             */
+            message?: string | undefined;
+            /**
+             * The `actual` property on the error instance.
+             */
+            actual?: unknown;
+            /**
+             * The `expected` property on the error instance.
+             */
+            expected?: unknown;
+            /**
+             * The `operator` property on the error instance.
+             */
+            operator?: string | undefined;
+            /**
+             * If provided, the generated stack trace omits frames before this function.
+             */
+            stackStartFn?: Function | undefined;
+            /**
+             * If set to `'full'`, shows the full diff in assertion errors.
+             * @default 'simple'
+             */
+            diff?: "simple" | "full" | undefined;
+        }
         /**
          * Indicates the failure of an assertion. All errors thrown by the `node:assert` module will be instances of the `AssertionError` class.
          */
         class AssertionError extends Error {
+            constructor(options: AssertionErrorOptions);
             /**
              * Set to the `actual` argument for methods such as {@link assert.strictEqual()}.
              */
@@ -23,10 +169,6 @@ declare module "assert" {
              * Set to the `expected` argument for methods such as {@link assert.strictEqual()}.
              */
             expected: unknown;
-            /**
-             * Set to the passed in operator value.
-             */
-            operator: string;
             /**
              * Indicates if the message was auto-generated (`true`) or not.
              */
@@ -35,19 +177,10 @@ declare module "assert" {
              * Value is always `ERR_ASSERTION` to show that the error is an assertion error.
              */
             code: "ERR_ASSERTION";
-            constructor(options?: {
-                /** If provided, the error message is set to this value. */
-                message?: string | undefined;
-                /** The `actual` property on the error instance. */
-                actual?: unknown | undefined;
-                /** The `expected` property on the error instance. */
-                expected?: unknown | undefined;
-                /** The `operator` property on the error instance. */
-                operator?: string | undefined;
-                /** If provided, the generated stack trace omits frames before this function. */
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
-                stackStartFn?: Function | undefined;
-            });
+            /**
+             * Set to the passed in operator value.
+             */
+            operator: string;
         }
         /**
          * This feature is deprecated and will be removed in a future version.
@@ -970,83 +1103,9 @@ declare module "assert" {
          * @since v22.13.0
          */
         function partialDeepStrictEqual(actual: unknown, expected: unknown, message?: string | Error): void;
-        /**
-         * In strict assertion mode, non-strict methods behave like their corresponding strict methods. For example,
-         * {@link deepEqual} will behave like {@link deepStrictEqual}.
-         *
-         * In strict assertion mode, error messages for objects display a diff. In legacy assertion mode, error
-         * messages for objects display the objects, often truncated.
-         *
-         * To use strict assertion mode:
-         *
-         * ```js
-         * import { strict as assert } from 'node:assert';
-         * import assert from 'node:assert/strict';
-         * ```
-         *
-         * Example error diff:
-         *
-         * ```js
-         * import { strict as assert } from 'node:assert';
-         *
-         * assert.deepEqual([[[1, 2, 3]], 4, 5], [[[1, 2, '3']], 4, 5]);
-         * // AssertionError: Expected inputs to be strictly deep-equal:
-         * // + actual - expected ... Lines skipped
-         * //
-         * //   [
-         * //     [
-         * // ...
-         * //       2,
-         * // +     3
-         * // -     '3'
-         * //     ],
-         * // ...
-         * //     5
-         * //   ]
-         * ```
-         *
-         * To deactivate the colors, use the `NO_COLOR` or `NODE_DISABLE_COLORS` environment variables. This will also
-         * deactivate the colors in the REPL. For more on color support in terminal environments, read the tty
-         * `getColorDepth()` documentation.
-         *
-         * @since v15.0.0, v13.9.0, v12.16.2, v9.9.0
-         */
-        namespace strict {
-            type AssertionError = assert.AssertionError;
-            type AssertPredicate = assert.AssertPredicate;
-            type CallTrackerCall = assert.CallTrackerCall;
-            type CallTrackerReportInformation = assert.CallTrackerReportInformation;
-        }
-        const strict:
-            & Omit<
-                typeof assert,
-                | "equal"
-                | "notEqual"
-                | "deepEqual"
-                | "notDeepEqual"
-                | "ok"
-                | "strictEqual"
-                | "deepStrictEqual"
-                | "ifError"
-                | "strict"
-                | "AssertionError"
-            >
-            & {
-                (value: unknown, message?: string | Error): asserts value;
-                equal: typeof strictEqual;
-                notEqual: typeof notStrictEqual;
-                deepEqual: typeof deepStrictEqual;
-                notDeepEqual: typeof notDeepStrictEqual;
-                // Mapped types and assertion functions are incompatible?
-                // TS2775: Assertions require every name in the call target
-                // to be declared with an explicit type annotation.
-                ok: typeof ok;
-                strictEqual: typeof strictEqual;
-                deepStrictEqual: typeof deepStrictEqual;
-                ifError: typeof ifError;
-                strict: typeof strict;
-                AssertionError: typeof AssertionError;
-            };
+    }
+    namespace assert {
+        export { strict };
     }
     export = assert;
 }

package/node_modules/@types/node/buffer.buffer.d.ts

@@ -451,7 +451,16 @@ declare module "buffer" {
              */
             subarray(start?: number, end?: number): Buffer<TArrayBuffer>;
         }
+        // TODO: remove globals in future version
+        /**
+         * @deprecated This is intended for internal use, and will be removed once `@types/node` no longer supports
+         * TypeScript versions earlier than 5.7.
+         */
         type NonSharedBuffer = Buffer<ArrayBuffer>;
+        /**
+         * @deprecated This is intended for internal use, and will be removed once `@types/node` no longer supports
+         * TypeScript versions earlier than 5.7.
+         */
         type AllowSharedBuffer = Buffer<ArrayBufferLike>;
     }
     /** @deprecated Use `Buffer.allocUnsafeSlow()` instead. */

package/node_modules/@types/node/buffer.d.ts

@@ -59,7 +59,7 @@ declare module "buffer" {
      * @since v19.4.0, v18.14.0
      * @param input The input to validate.
      */
-    export function isUtf8(input: Buffer | ArrayBuffer | NodeJS.TypedArray): boolean;
+    export function isUtf8(input: ArrayBuffer | NodeJS.TypedArray): boolean;
     /**
      * This function returns `true` if `input` contains only valid ASCII-encoded data,
      * including the case in which `input` is empty.
@@ -68,7 +68,7 @@ declare module "buffer" {
      * @since v19.6.0, v18.15.0
      * @param input The input to validate.
      */
-    export function isAscii(input: Buffer | ArrayBuffer | NodeJS.TypedArray): boolean;
+    export function isAscii(input: ArrayBuffer | NodeJS.TypedArray): boolean;
     export let INSPECT_MAX_BYTES: number;
     export const kMaxLength: number;
     export const kStringMaxLength: number;
@@ -113,7 +113,11 @@ declare module "buffer" {
      * @param fromEnc The current encoding.
      * @param toEnc To target encoding.
      */
-    export function transcode(source: Uint8Array, fromEnc: TranscodeEncoding, toEnc: TranscodeEncoding): Buffer;
+    export function transcode(
+        source: Uint8Array,
+        fromEnc: TranscodeEncoding,
+        toEnc: TranscodeEncoding,
+    ): NonSharedBuffer;
     /**
      * Resolves a `'blob:nodedata:...'` an associated `Blob` object registered using
      * a prior call to `URL.createObjectURL()`.
@@ -330,7 +334,7 @@ declare module "buffer" {
              * @return The number of bytes contained within `string`.
              */
             byteLength(
-                string: string | Buffer | NodeJS.ArrayBufferView | ArrayBuffer | SharedArrayBuffer,
+                string: string | NodeJS.ArrayBufferView | ArrayBufferLike,
                 encoding?: BufferEncoding,
             ): number;
             /**