@contrast/agent-bundle 5.46.0 → 5.48.0

package/node_modules/yaml/browser/dist/compose/compose-collection.js

@@ -59,7 +59,7 @@ function composeCollection(CN, ctx, token, props, onError) {
     let tag = ctx.schema.tags.find(t => t.tag === tagName && t.collection === expType);
     if (!tag) {
         const kt = ctx.schema.knownTags[tagName];
-        if (kt && kt.collection === expType) {
+        if (kt?.collection === expType) {
             ctx.schema.tags.push(Object.assign({}, kt, { default: false }));
             tag = kt;
         }

package/node_modules/yaml/browser/dist/compose/resolve-block-seq.js

@@ -22,7 +22,7 @@ function resolveBlockSeq({ composeNode, composeEmptyNode }, ctx, bs, onError, ta
         });
         if (!props.found) {
             if (props.anchor || props.tag || value) {
-                if (value && value.type === 'block-seq')
+                if (value?.type === 'block-seq')
                     onError(props.end, 'BAD_INDENT', 'All sequence items must start at the same column');
                 else
                     onError(offset, 'MISSING_CHAR', 'Sequence item without - indicator');

package/node_modules/yaml/browser/dist/compose/resolve-flow-collection.js

@@ -133,7 +133,7 @@ function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onErr
                 }
             }
             else if (value) {
-                if ('source' in value && value.source && value.source[0] === ':')
+                if ('source' in value && value.source?.[0] === ':')
                     onError(value, 'MISSING_CHAR', `Missing space after : in ${fcName}`);
                 else
                     onError(valueProps.start, 'MISSING_CHAR', `Missing , or : between ${fcName} items`);
@@ -177,7 +177,7 @@ function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onErr
     const expectedEnd = isMap ? '}' : ']';
     const [ce, ...ee] = fc.end;
     let cePos = offset;
-    if (ce && ce.source === expectedEnd)
+    if (ce?.source === expectedEnd)
         cePos = ce.offset + ce.source.length;
     else {
         const name = fcName[0].toUpperCase() + fcName.substring(1);

package/node_modules/yaml/browser/dist/errors.js

@@ -46,7 +46,7 @@ const prettifyError = (src, lc) => (error) => {
     if (/[^ ]/.test(lineStr)) {
         let count = 1;
         const end = error.linePos[1];
-        if (end && end.line === line && end.col > col) {
+        if (end?.line === line && end.col > col) {
             count = Math.max(1, Math.min(end.col - col, 80 - ci));
         }
         const pointer = ' '.repeat(ci) + '^'.repeat(count);

package/node_modules/yaml/browser/dist/nodes/Alias.js

@@ -59,7 +59,7 @@ class Alias extends NodeBase {
             data = anchors.get(source);
         }
         /* istanbul ignore if */
-        if (!data || data.res === undefined) {
+        if (data?.res === undefined) {
             const msg = 'This should not happen: Alias anchor was not resolved?';
             throw new ReferenceError(msg);
         }

package/node_modules/yaml/browser/dist/parse/parser.js

@@ -226,7 +226,7 @@ class Parser {
     }
     *step() {
         const top = this.peek(1);
-        if (this.type === 'doc-end' && (!top || top.type !== 'doc-end')) {
+        if (this.type === 'doc-end' && top?.type !== 'doc-end') {
             while (this.stack.length > 0)
                 yield* this.pop();
             this.stack.push({
@@ -758,7 +758,7 @@ class Parser {
             do {
                 yield* this.pop();
                 top = this.peek(1);
-            } while (top && top.type === 'flow-collection');
+            } while (top?.type === 'flow-collection');
         }
         else if (fc.end.length === 0) {
             switch (this.type) {

package/node_modules/yaml/browser/dist/stringify/stringifyNumber.js

@@ -4,7 +4,7 @@ function stringifyNumber({ format, minFractionDigits, tag, value }) {
     const num = typeof value === 'number' ? value : Number(value);
     if (!isFinite(num))
         return isNaN(num) ? '.nan' : num < 0 ? '-.inf' : '.inf';
-    let n = JSON.stringify(value);
+    let n = Object.is(value, -0) ? '-0' : JSON.stringify(value);
     if (!format &&
         minFractionDigits &&
         (!tag || tag === 'tag:yaml.org,2002:float') &&

package/node_modules/yaml/browser/dist/stringify/stringifyPair.js

@@ -101,7 +101,7 @@ function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
             ws += `\n${indentComment(cs, ctx.indent)}`;
         }
         if (valueStr === '' && !ctx.inFlow) {
-            if (ws === '\n')
+            if (ws === '\n' && valueComment)
                 ws = '\n\n';
         }
         else {

package/node_modules/yaml/dist/compose/compose-collection.js

@@ -61,7 +61,7 @@ function composeCollection(CN, ctx, token, props, onError) {
     let tag = ctx.schema.tags.find(t => t.tag === tagName && t.collection === expType);
     if (!tag) {
         const kt = ctx.schema.knownTags[tagName];
-        if (kt && kt.collection === expType) {
+        if (kt?.collection === expType) {
             ctx.schema.tags.push(Object.assign({}, kt, { default: false }));
             tag = kt;
         }

package/node_modules/yaml/dist/compose/resolve-block-seq.js

@@ -24,7 +24,7 @@ function resolveBlockSeq({ composeNode, composeEmptyNode }, ctx, bs, onError, ta
         });
         if (!props.found) {
             if (props.anchor || props.tag || value) {
-                if (value && value.type === 'block-seq')
+                if (value?.type === 'block-seq')
                     onError(props.end, 'BAD_INDENT', 'All sequence items must start at the same column');
                 else
                     onError(offset, 'MISSING_CHAR', 'Sequence item without - indicator');

package/node_modules/yaml/dist/compose/resolve-flow-collection.js

@@ -135,7 +135,7 @@ function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onErr
                 }
             }
             else if (value) {
-                if ('source' in value && value.source && value.source[0] === ':')
+                if ('source' in value && value.source?.[0] === ':')
                     onError(value, 'MISSING_CHAR', `Missing space after : in ${fcName}`);
                 else
                     onError(valueProps.start, 'MISSING_CHAR', `Missing , or : between ${fcName} items`);
@@ -179,7 +179,7 @@ function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onErr
     const expectedEnd = isMap ? '}' : ']';
     const [ce, ...ee] = fc.end;
     let cePos = offset;
-    if (ce && ce.source === expectedEnd)
+    if (ce?.source === expectedEnd)
         cePos = ce.offset + ce.source.length;
     else {
         const name = fcName[0].toUpperCase() + fcName.substring(1);

package/node_modules/yaml/dist/errors.js

@@ -48,7 +48,7 @@ const prettifyError = (src, lc) => (error) => {
     if (/[^ ]/.test(lineStr)) {
         let count = 1;
         const end = error.linePos[1];
-        if (end && end.line === line && end.col > col) {
+        if (end?.line === line && end.col > col) {
             count = Math.max(1, Math.min(end.col - col, 80 - ci));
         }
         const pointer = ' '.repeat(ci) + '^'.repeat(count);

package/node_modules/yaml/dist/nodes/Alias.js

@@ -61,7 +61,7 @@ class Alias extends Node.NodeBase {
             data = anchors.get(source);
         }
         /* istanbul ignore if */
-        if (!data || data.res === undefined) {
+        if (data?.res === undefined) {
             const msg = 'This should not happen: Alias anchor was not resolved?';
             throw new ReferenceError(msg);
         }

package/node_modules/yaml/dist/parse/parser.js

@@ -231,7 +231,7 @@ class Parser {
     }
     *step() {
         const top = this.peek(1);
-        if (this.type === 'doc-end' && (!top || top.type !== 'doc-end')) {
+        if (this.type === 'doc-end' && top?.type !== 'doc-end') {
             while (this.stack.length > 0)
                 yield* this.pop();
             this.stack.push({
@@ -763,7 +763,7 @@ class Parser {
             do {
                 yield* this.pop();
                 top = this.peek(1);
-            } while (top && top.type === 'flow-collection');
+            } while (top?.type === 'flow-collection');
         }
         else if (fc.end.length === 0) {
             switch (this.type) {

package/node_modules/yaml/dist/stringify/stringifyNumber.js

@@ -6,7 +6,7 @@ function stringifyNumber({ format, minFractionDigits, tag, value }) {
     const num = typeof value === 'number' ? value : Number(value);
     if (!isFinite(num))
         return isNaN(num) ? '.nan' : num < 0 ? '-.inf' : '.inf';
-    let n = JSON.stringify(value);
+    let n = Object.is(value, -0) ? '-0' : JSON.stringify(value);
     if (!format &&
         minFractionDigits &&
         (!tag || tag === 'tag:yaml.org,2002:float') &&

package/node_modules/yaml/dist/stringify/stringifyPair.js

@@ -103,7 +103,7 @@ function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
             ws += `\n${stringifyComment.indentComment(cs, ctx.indent)}`;
         }
         if (valueStr === '' && !ctx.inFlow) {
-            if (ws === '\n')
+            if (ws === '\n' && valueComment)
                 ws = '\n\n';
         }
         else {

package/node_modules/yaml/package.json

@@ -1,8 +1,9 @@
 {
   "name": "yaml",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "license": "ISC",
   "author": "Eemeli Aro <eemeli@gmail.com>",
+  "funding": "https://github.com/sponsors/eemeli",
   "repository": "github:eemeli/yaml",
   "description": "JavaScript parser and stringifier for YAML",
   "keywords": [
@@ -73,14 +74,13 @@
     "@babel/preset-env": "^7.12.11",
     "@eslint/js": "^9.9.1",
     "@rollup/plugin-babel": "^6.0.3",
-    "@rollup/plugin-replace": "^5.0.2",
+    "@rollup/plugin-replace": "^6.0.3",
     "@rollup/plugin-typescript": "^12.1.1",
     "@types/jest": "^29.2.4",
     "@types/node": "^20.11.20",
     "babel-jest": "^29.0.1",
-    "cross-env": "^7.0.3",
     "eslint": "^9.9.1",
-    "eslint-config-prettier": "^9.0.0",
+    "eslint-config-prettier": "^10.1.8",
     "fast-check": "^2.12.0",
     "jest": "^29.0.1",
     "jest-resolve": "^29.7.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent-bundle",
-  "version": "5.46.0",
+  "version": "5.48.0",
   "description": "Contrast Security Node.js Agent bundle with all dependencies included",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,13 +21,13 @@
   "main": "./lib/index.js",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">=18.7.0 <19 || >=20.6.0 <21 || >= 22.5.1 <23 || >= 24.0.1 <25"
+    "node": ">=18.7.0 <19 || >=20.9.0 <21 || >= 22.5.1 <23 || >= 24.0.1 <25"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent": "5.46.0"
+    "@contrast/agent": "5.48.0"
   },
   "bundleDependencies": [
     "@contrast/agent"

package/node_modules/@contrast/protect/lib/input-analysis/install/koa-body5.js

@@ -1,63 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { patchType } = require('../constants');
-
-module.exports = (core) => {
-  const {
-    depHooks,
-    patcher,
-    protect,
-    protect: { inputAnalysis },
-  } = core;
-
-  // Patch `koa-body` package
-  function install() {
-    depHooks.resolve({ name: 'koa-body', version: '<7' }, (koaBody) => patcher.patch(koaBody, {
-      name: 'koa-body',
-      patchType,
-      post(data) {
-        data.result = patcher.patch(data.result, {
-          name: 'koa-body',
-          patchType,
-          pre(data) {
-            const [ctx, origNext] = data.args;
-
-            async function contrastNext(origErr) {
-              const sourceContext = protect.getSourceContext();
-
-              if (sourceContext && ctx.request.body && Object.keys(ctx.request.body).length) {
-                sourceContext.parsedBody = ctx.request.body;
-                inputAnalysis.handleParsedBody(sourceContext, ctx.request.body);
-              }
-
-              await origNext(origErr);
-            }
-
-            data.args[1] = contrastNext;
-          }
-        });
-      }
-    }));
-  }
-
-  const koaBody5Instrumentation = inputAnalysis.koaBody5Instrumentation = {
-    install
-  };
-
-  return koaBody5Instrumentation;
-};

package/node_modules/@contrast/protect/lib/input-analysis/install/koa-bodyparser4.js

@@ -1,64 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { patchType } = require('../constants');
-
-module.exports = (core) => {
-  const {
-    depHooks,
-    patcher,
-    protect,
-    protect: { inputAnalysis },
-  } = core;
-
-  // Patch `koa-bodyparser` package
-  function install() {
-    depHooks.resolve({ name: 'koa-bodyparser', version: '<5' }, (koaBodyparser) => patcher.patch(koaBodyparser, {
-      name: 'koa-bodyparser',
-      patchType,
-      post(data) {
-        data.result = patcher.patch(data.result, {
-          name: 'koa-bodyparser',
-          patchType,
-          pre(data) {
-            const [ctx, origNext] = data.args;
-
-            async function contrastNext(origErr) {
-              const sourceContext = protect.getSourceContext();
-
-
-              if (sourceContext && ctx.request.body && Object.keys(ctx.request.body).length) {
-                sourceContext.parsedBody = ctx.request.body;
-                inputAnalysis.handleParsedBody(sourceContext, ctx.request.body);
-              }
-
-              await origNext(origErr);
-            }
-
-            data.args[1] = contrastNext;
-          }
-        });
-      }
-    }));
-  }
-
-  const koaBodyparser4Instrumentation = inputAnalysis.koaBodyparser4Instrumentation = {
-    install
-  };
-
-  return koaBodyparser4Instrumentation;
-};

package/node_modules/@contrast/route-coverage/lib/install/express/express4.js

@@ -1,157 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-'use strict';
-
-const METHODS = [
-  'all',
-  'get',
-  'post',
-  'put',
-  'delete',
-  'patch',
-  'options',
-  'head',
-];
-
-const fnInspect = require('@contrast/fn-inspect');
-const { createSignature, patchType } = require('../../utils/route-info');
-const { isString, primordials: { ArrayPrototypeJoin, StringPrototypeToLowerCase, StringPrototypeReplace, StringPrototypeReplaceAll, StringPrototypeSplit, StringPrototypeSlice } } = require('@contrast/common');
-
-// Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Express
-module.exports = function init(core) {
-  const { patcher, depHooks, routeCoverage } = core;
-  const discover = (route) => routeCoverage.discover(route);
-  const observe = (route) => routeCoverage.observe(route);
-
-  const isRoute = (layer) => !!layer.route;
-  const isRouter = (layer) => layer.name && StringPrototypeToLowerCase.call(layer.name) === 'router';
-  const isValidPath = (path) => isString(path) || Array.isArray(path) || path instanceof RegExp;
-  const getHandleMethod = (layer) => fnInspect.funcInfo(layer.__handle)?.file.includes('express-async-errors') ? '__handle' : 'handle';
-  const getLastLayer = (router) => router?.stack[router.stack.length - 1];
-
-  function regExpToPath(regex) {
-    if (regex.source) {
-      let [path] = StringPrototypeSplit.call(regex?.source, '/?');
-      path = StringPrototypeReplaceAll.call(path, '\\', '');
-      path = StringPrototypeReplace.call(path, '^', '');
-      return path;
-    }
-  }
-
-  function format(url) {
-    if (Array.isArray(url)) {
-      return `/[${ArrayPrototypeJoin.call(url)}]`;
-    } else if (url instanceof RegExp) {
-      return `/{${StringPrototypeSlice.call(url.toString(), 1, -1)}}`;
-    } else {
-      return url;
-    }
-  }
-
-  function parseRoute(route) {
-    const { path } = route;
-    const method = route.methods._all ? 'all' : route.stack[0].method;
-    return { url: format(path), method };
-  }
-
-
-  function createRouteInfo(url, method, obj) {
-    return {
-      signature: createSignature(url, method, obj),
-      url,
-      normalizedUrl: url,
-      method,
-      framework: 'express'
-    };
-  }
-
-  function patchHandle(layer, routeInfo) {
-    const handle = getHandleMethod(layer);
-    patcher.patch(layer, handle, {
-      name: 'express.Route.handle',
-      patchType,
-      post({ args }) {
-        const [req] = args;
-        const [url] = StringPrototypeSplit.call(req.originalUrl, '?');
-        const { method } = req;
-        if (url && method) {
-          observe({ ...routeInfo, url, method: StringPrototypeToLowerCase.call(method) });
-        }
-      }
-    });
-  }
-
-  function traverse(stack, path = '', depth = 0) {
-    path = format(path);
-    stack.forEach((layer) => {
-      if (isRoute(layer)) {
-        const { url, method } = parseRoute(layer.route);
-        const routeInfo = createRouteInfo(path + url, method);
-        discover(routeInfo);
-        patchHandle(layer, routeInfo);
-      } else if (isRouter(layer)) {
-        const regexPath = regExpToPath(layer.regexp);
-        if (depth < 3) traverse(layer.handle.stack, path + regexPath, depth += 1);
-      } else {
-        const regexPath = regExpToPath(layer.regexp);
-        const routeInfo = createRouteInfo(path + regexPath, 'use');
-        discover(routeInfo);
-        patchHandle(layer, routeInfo);
-      }
-    });
-  }
-  return core.routeCoverage.express4 = {
-    install() {
-      depHooks.resolve({ name: 'express', version: '>=4 <5' }, (express) => {
-        patcher.patch(express.application, 'use', {
-          name: 'express.application.use',
-          patchType,
-          post({ args, result }) {
-            const len = args.length;
-            const fn = args[len - 1];
-            const path = len > 1 ? args[0] : undefined;
-            if (path && !isValidPath(path)) return;
-            const handlers = Array.isArray(fn) ? fn : [fn];
-            handlers.forEach((layer) => {
-              if (isRouter(layer)) {
-                traverse(layer.stack, path);
-              } else if (path) {
-                const routeInfo = createRouteInfo(format(path), 'use', 'App');
-                discover(routeInfo);
-                const lastLayer = getLastLayer(result._router);
-                if (lastLayer) patchHandle(lastLayer, routeInfo);
-              }
-            });
-          }
-        });
-
-        METHODS.forEach((method) => {
-          patcher.patch(express.application, method, {
-            name: `express.application.${method}`,
-            patchType,
-            post({ args, result }) {
-              const [url, fn] = args;
-              if (!url || !fn || !isValidPath(url)) return;
-              const routeInfo = createRouteInfo(format(url), method, 'App');
-              discover(routeInfo);
-              const lastLayer = getLastLayer(result._router);
-              if (lastLayer) patchHandle(lastLayer, routeInfo);
-            }
-          });
-        });
-      });
-    }
-  };
-};