@contrast/agent-bundle 5.46.0 → 5.48.0

package/node_modules/@contrast/common/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/common",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "Shared constants and utilities for all Contrast Agent modules",
   "license": "UNLICENSED",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",

package/node_modules/@contrast/config/lib/common.js

@@ -106,6 +106,7 @@ const mappings = {
     }
   },
   'assess.probabilistic_sampling.window_ms': (remoteData) => remoteData.assess?.sampling?.window_ms,
+  'assess.report_middleware_routes': (remoteData) => remoteData.assess?.report_middleware_routes,
   'assess.stacktraces': (remoteData) => remoteData.assess?.report_stacktraces,
   'agent.logger.level': coerceLowerCase('logger.level'),
   'agent.logger.path': (remoteData) => remoteData.logger?.path,

package/node_modules/@contrast/config/lib/options.js

@@ -699,7 +699,13 @@ Example - \`label1, label2, label3\``,
     fn: split,
     desc: 'Define a list of Protect rules to disable in the agent. The rules must be formatted as a comma-delimited list.',
   },
-
+  {
+    name: 'assess.report_middleware_routes',
+    arg: '[false]',
+    default: false,
+    fn: castBoolean,
+    desc: 'Set to `true` to report both discovered and observed routes for middleware to the Contrast backend.',
+  },
   {
     name: 'assess.safe_positives.enable',
     arg: '[false]',

package/node_modules/@contrast/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/config",
-  "version": "1.53.0",
+  "version": "1.54.1",
   "description": "An API for discovering Contrast agent configuration data",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,8 +20,8 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/core": "1.58.0",
+    "@contrast/common": "1.38.0",
+    "@contrast/core": "1.59.1",
     "deepmerge": "^4.3.1",
     "yaml": "^2.2.2"
   }

package/node_modules/@contrast/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/core",
-  "version": "1.58.0",
+  "version": "1.59.1",
   "description": "Preconfigured Contrast agent core services and models",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -19,12 +19,12 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/config": "1.53.0",
+    "@contrast/common": "1.38.0",
+    "@contrast/config": "1.54.1",
     "@contrast/find-package-json": "^1.1.0",
     "@contrast/fn-inspect": "^5.0.2",
-    "@contrast/logger": "1.31.0",
-    "@contrast/patcher": "1.30.0",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1",
     "@contrast/perf": "1.4.0",
     "@tsxper/crc32": "^2.1.3",
     "axios": "^1.12.2",

package/node_modules/@contrast/deadzones/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/deadzones",
-  "version": "1.30.0",
+  "version": "1.31.1",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,9 +20,9 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/dep-hooks": "1.27.0",
-    "@contrast/patcher": "1.30.0",
-    "@contrast/scopes": "1.28.0"
+    "@contrast/common": "1.38.0",
+    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/patcher": "1.31.1",
+    "@contrast/scopes": "1.29.1"
   }
 }

package/node_modules/@contrast/dep-hooks/lib/export-handler-registry.js

@@ -120,16 +120,7 @@ class ExportHandlerRegistry {
      * @returns {PackageFinder.Metadata?}
      */
     resolveMetadata(filename) {
-        let metadata = PackageFinder.resolveMetadata(filename, this.nodeModulesDir, this.logger);
-        // See NODE-3859
-        // In rare cases, a library can be structured in such a way that require()-able sub-directories
-        // also contain a package.json with little metadata which is resolved first and then
-        // instrumentation will fail because it doesn't match the target library
-        if (!metadata?.name || !metadata?.version) {
-            this.logger?.debug('incomplete info found in %s; searching in parent directories', filename);
-            metadata = PackageFinder.resolveMetadata(path.resolve(filename, '..'), this.nodeModulesDir, this.logger);
-        }
-        return metadata;
+        return PackageFinder.resolveMetadata(filename, this.nodeModulesDir, this.logger);
     }
     /**
      * Iterates all descriptors pertaining to the currently-loading export. It

package/node_modules/@contrast/dep-hooks/lib/export-hook-descriptor.js

@@ -52,7 +52,7 @@ class ExportHookDescriptor {
         this.name = Module.isBuiltin(name) ? StringPrototypeReplace.call(name, /^(node:)?/, 'node:') : name;
         /** @type {string=} */
         // @ts-ignore ts does not handle method overloads well
-        this.file = file ? StringPrototypeReplace.call(file, /\/?(index)?(\.js)?$/, '') : undefined;
+        this.file = file ? StringPrototypeReplace.call(file, /\/?(index)?(\.c?js)?$/, '') : undefined;
         /** @type {string} */
         this.shortname = this.file ? path.posix.join(this.name, this.file) : this.name;
         /** @type {string} */

package/node_modules/@contrast/dep-hooks/lib/index.d.ts

@@ -51,7 +51,7 @@ declare class DepHooks {
     /** @type {Set<string>} */
     resets: Set<string>;
     /**
-     * Registers handlers to run afer the described module is required.
+     * Registers handlers to run after the described module is required.
      * @template {Object} T
      * @param {ExportHookDescriptor.Descriptor | string} descriptor describes the module to hook
      * @param {ExportHookDescriptor.Handler<T>[]} handlers the function hooks to execute after require

package/node_modules/@contrast/dep-hooks/lib/index.js

@@ -52,7 +52,7 @@ class DepHooks {
         this.resets = new Set();
     }
     /**
-     * Registers handlers to run afer the described module is required.
+     * Registers handlers to run after the described module is required.
      * @template {Object} T
      * @param {ExportHookDescriptor.Descriptor | string} descriptor describes the module to hook
      * @param {ExportHookDescriptor.Handler<T>[]} handlers the function hooks to execute after require

package/node_modules/@contrast/dep-hooks/lib/package-finder.d.ts

@@ -36,9 +36,10 @@ export type Metadata = {
 /**
  * Resolves the metadata of a package given it's resolved name.
  * @param {string=} file Absolute path to the module file
- * @param {string=} file Absolute path to the node_modules directory
+ * @param {string=} nodeModulesDir Absolute path to the node_modules directory
  * @param {import('pino').Logger=} logger
+ * @param {string=} startAt Optional path to start searching for package.json from when recursing
  * @returns {Metadata?}
  */
-export function resolveMetadata(file?: string | undefined, nodeModulesDir: any, logger?: import("pino").Logger | undefined): Metadata | null;
+export function resolveMetadata(file?: string | undefined, nodeModulesDir?: string | undefined, logger?: import("pino").Logger | undefined, startAt?: string | undefined): Metadata | null;
 //# sourceMappingURL=package-finder.d.ts.map

package/node_modules/@contrast/dep-hooks/lib/package-finder.js

@@ -16,6 +16,7 @@
 const path = require('node:path');
 const Module = require('node:module');
 const { findPackageJsonSync } = require('@contrast/find-package-json');
+const semver = require('semver');
 const { getShortname } = require('./helpers');
 const { primordials: { StringPrototypeReplace, StringPrototypeSubstring, JSONParse, FsReadFileSync } } = require('@contrast/common');
 /**
@@ -30,11 +31,12 @@ const { primordials: { StringPrototypeReplace, StringPrototypeSubstring, JSONPar
 /**
  * Resolves the metadata of a package given it's resolved name.
  * @param {string=} file Absolute path to the module file
- * @param {string=} file Absolute path to the node_modules directory
+ * @param {string=} nodeModulesDir Absolute path to the node_modules directory
  * @param {import('pino').Logger=} logger
+ * @param {string=} startAt Optional path to start searching for package.json from when recursing
  * @returns {Metadata?}
  */
-function resolveMetadata(file, nodeModulesDir, logger) {
+function resolveMetadata(file, nodeModulesDir, logger, startAt) {
     if (!file) {
         return null;
     }
@@ -49,7 +51,7 @@ function resolveMetadata(file, nodeModulesDir, logger) {
             shortname: file,
         };
     }
-    const resolved = path.dirname(file);
+    const resolved = path.dirname(startAt ?? file);
     const pdj = findPackageJsonSync({ cwd: resolved, stopAt: nodeModulesDir });
     if (!pdj) {
         logger?.error('unable to find package.json for %s', file);
@@ -59,9 +61,17 @@ function resolveMetadata(file, nodeModulesDir, logger) {
         const json = FsReadFileSync(pdj, 'utf8');
         const { name, version, main } = JSONParse(json);
         const packageDir = path.dirname(pdj);
+        // See NODE-3859
+        // In rare cases, a library can be structured in such a way that require()-able sub-directories
+        // also contain a package.json with little metadata which is resolved first and then
+        // instrumentation will fail because it doesn't match the target library
+        if (!name || !version) {
+            logger?.trace({ file }, 'incomplete package.json found at %s; searching in parent directories', pdj);
+            return resolveMetadata(file, nodeModulesDir, logger, packageDir);
+        }
         return {
             name,
-            version,
+            version: semver.clean(version, { loose: true }),
             packageDir,
             file,
             shortname: getShortname({ name, packageDir, file, main }),

package/node_modules/@contrast/dep-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/dep-hooks",
-  "version": "1.27.0",
+  "version": "1.28.1",
   "description": "Post hooks for Module.prototype.require",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,10 +21,10 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/core": "1.58.0",
+    "@contrast/common": "1.38.0",
+    "@contrast/core": "1.59.1",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/logger": "1.31.0",
+    "@contrast/logger": "1.32.1",
     "semver": "^7.6.3"
   }
 }

package/node_modules/@contrast/esm-hooks/README.md

@@ -36,7 +36,7 @@ node -r @contrast/agent app-main.js [app arguments]
 node --loader @contrast/agent app-main.mjs [app arguments]
 ```
 
-#### ESM Support for Node version >= 18.19.0 and < 20.0.0 || >= 20.6.0
+#### ESM Support for Node version >= 18.19.0 and < 20.0.0 || >= 20.9.0
 
 ```bash
 # use --import to start the application
@@ -44,7 +44,7 @@ node --import @contrast/agent app-main.mjs [app arguments]
 ```
 
 > [!NOTE]
-> Contrast does not support Node versions >= 20.0.0 and < 20.6.0.
+> Contrast does not support Node versions >= 20.0.0 and < 20.9.0.
 
 
 

package/node_modules/@contrast/esm-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/esm-hooks",
-  "version": "2.33.0",
+  "version": "2.34.1",
   "type": "module",
   "description": "Support for loading and instrumenting ECMAScript modules",
   "license": "SEE LICENSE IN LICENSE",
@@ -22,11 +22,11 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/config": "1.53.0",
-    "@contrast/core": "1.58.0",
+    "@contrast/common": "1.38.0",
+    "@contrast/config": "1.54.1",
+    "@contrast/core": "1.59.1",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/logger": "1.31.0",
-    "@contrast/rewriter": "1.35.0"
+    "@contrast/logger": "1.32.1",
+    "@contrast/rewriter": "1.36.1"
   }
 }

package/node_modules/@contrast/instrumentation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/instrumentation",
-  "version": "1.37.0",
+  "version": "1.38.1",
   "description": "Shared hooks and patches between Protect and Assess components",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,9 +20,9 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.37.0",
-    "@contrast/dep-hooks": "1.27.0",
-    "@contrast/logger": "1.31.0",
-    "@contrast/patcher": "1.30.0"
+    "@contrast/common": "1.38.0",
+    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1"
   }
 }