@contrast/agent-bundle 5.47.0 → 5.48.0

package/node_modules/@pinojs/redact/test/prototype-pollution.test.js

@@ -0,0 +1,223 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+/* eslint-disable no-proto */
+
+test('prototype pollution: __proto__ path should not pollute Object prototype', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property if it exists as a regular property
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: constructor.prototype path should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    constructor: {
+      prototype: { isAdmin: true }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['constructor.prototype.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the constructor.prototype property if it exists as a regular property
+  assert.strictEqual(result.constructor.prototype.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: nested __proto__ should not pollute', () => {
+  const obj = {
+    user: {
+      settings: {
+        __proto__: { isAdmin: true }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['user.settings.__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the nested __proto__ property
+  assert.strictEqual(result.user.settings.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: bracket notation __proto__ should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['["__proto__"]["isAdmin"]'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property when accessed via bracket notation
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: wildcard with __proto__ should not pollute', () => {
+  const obj = {
+    users: {
+      __proto__: { isAdmin: true },
+      user1: { name: 'john' },
+      user2: { name: 'jane' }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['users.*'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact only own properties
+  assert.strictEqual(result.users.user1, '[REDACTED]')
+  assert.strictEqual(result.users.user2, '[REDACTED]')
+
+  // __proto__ should only be redacted if it's an own property, not inherited
+  if (Object.prototype.hasOwnProperty.call(obj.users, '__proto__')) {
+    assert.strictEqual(result.users.__proto__, '[REDACTED]')
+  }
+})
+
+test('prototype pollution: malicious JSON payload should not pollute', () => {
+  // Simulate a malicious payload that might come from JSON.parse
+  const maliciousObj = JSON.parse('{"user": {"name": "john"}, "__proto__": {"isAdmin": true}}')
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(maliciousObj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // The malicious payload should have been redacted
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: verify prototype chain is preserved', () => {
+  function CustomClass () {
+    this.data = 'test'
+  }
+  CustomClass.prototype.method = function () { return 'original' }
+
+  const obj = new CustomClass()
+
+  const redact = slowRedact({
+    paths: ['data'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should redact the data property
+  assert.strictEqual(result.data, '[REDACTED]')
+
+  // Should preserve the original prototype chain
+  assert.strictEqual(result.method(), 'original')
+  assert.strictEqual(Object.getPrototypeOf(result), CustomClass.prototype)
+})
+
+test('prototype pollution: setValue should not create prototype pollution', () => {
+  const obj = { user: { name: 'john' } }
+
+  // Try to pollute via non-existent path that could create __proto__
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should not create the path if it doesn't exist
+  // The __proto__ property may exist due to Object.create, but should not contain our redacted value
+  if (result.__proto__) {
+    assert.strictEqual(result.__proto__.isAdmin, undefined)
+  }
+})
+
+test('prototype pollution: deep nested prototype properties should not pollute', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          __proto__: { isAdmin: true },
+          constructor: {
+            prototype: { isEvil: true }
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: [
+      'level1.level2.level3.__proto__.isAdmin',
+      'level1.level2.level3.constructor.prototype.isEvil'
+    ],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual(Object.prototype.isEvil, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+  assert.strictEqual({}.isEvil, undefined)
+
+  // Should redact the deep nested properties
+  assert.strictEqual(result.level1.level2.level3.__proto__.isAdmin, '[REDACTED]')
+  assert.strictEqual(result.level1.level2.level3.constructor.prototype.isEvil, '[REDACTED]')
+})

package/node_modules/@pinojs/redact/test/selective-clone.test.js

@@ -0,0 +1,115 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+test('selective cloning shares references for non-redacted paths', () => {
+  const sharedObject = { unchanged: 'data' }
+  const obj = {
+    toRedact: 'secret',
+    shared: sharedObject,
+    nested: {
+      toRedact: 'secret2',
+      shared: sharedObject
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['toRedact', 'nested.toRedact'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Redacted values should be different
+  assert.strictEqual(result.toRedact, '[REDACTED]')
+  assert.strictEqual(result.nested.toRedact, '[REDACTED]')
+
+  // Non-redacted references should be shared (same object reference)
+  assert.strictEqual(result.shared, obj.shared)
+  assert.strictEqual(result.nested.shared, obj.nested.shared)
+
+  // The shared object should be the exact same reference
+  assert.strictEqual(result.shared, sharedObject)
+  assert.strictEqual(result.nested.shared, sharedObject)
+})
+
+test('selective cloning works with arrays', () => {
+  const sharedItem = { unchanged: 'data' }
+  const obj = {
+    items: [
+      { secret: 'hidden1', shared: sharedItem },
+      { secret: 'hidden2', shared: sharedItem },
+      sharedItem
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['items.*.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Secrets should be redacted
+  assert.strictEqual(result.items[0].secret, '[REDACTED]')
+  assert.strictEqual(result.items[1].secret, '[REDACTED]')
+
+  // Shared references should be preserved where possible
+  // Note: array items with secrets will be cloned, but their shared properties should still reference the original
+  assert.strictEqual(result.items[0].shared, sharedItem)
+  assert.strictEqual(result.items[1].shared, sharedItem)
+
+  // The third item gets cloned due to wildcard, but should have the same content
+  assert.deepStrictEqual(result.items[2], sharedItem)
+  // Note: Due to wildcard '*', all array items are cloned, even if they don't need redaction
+  // This is still a significant optimization for object properties that aren't in wildcard paths
+})
+
+test('selective cloning with no paths returns original object', () => {
+  const obj = { data: 'unchanged' }
+  const redact = slowRedact({
+    paths: [],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should return the exact same object reference
+  assert.strictEqual(result, obj)
+})
+
+test('selective cloning performance - large objects with minimal redaction', () => {
+  // Create a large object with mostly shared data
+  const sharedData = { large: 'data'.repeat(1000) }
+  const obj = {
+    secret: 'hidden',
+    shared1: sharedData,
+    shared2: sharedData,
+    nested: {
+      secret: 'hidden2',
+      shared3: sharedData,
+      deep: {
+        shared4: sharedData,
+        moreShared: sharedData
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['secret', 'nested.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Verify redaction worked
+  assert.strictEqual(result.secret, '[REDACTED]')
+  assert.strictEqual(result.nested.secret, '[REDACTED]')
+
+  // Verify shared references are preserved
+  assert.strictEqual(result.shared1, sharedData)
+  assert.strictEqual(result.shared2, sharedData)
+  assert.strictEqual(result.nested.shared3, sharedData)
+  assert.strictEqual(result.nested.deep.shared4, sharedData)
+  assert.strictEqual(result.nested.deep.moreShared, sharedData)
+})

package/node_modules/@pinojs/redact/tsconfig.json

@@ -0,0 +1,19 @@
+{
+    "compilerOptions": {
+        "module": "commonjs",
+        "lib": [
+            "es6"
+        ],
+        "noImplicitAny": true,
+        "noImplicitThis": true,
+        "strictFunctionTypes": true,
+        "strictNullChecks": true,
+        "types": [],
+        "noEmit": true,
+        "forceConsistentCasingInFileNames": true
+    },
+    "files": [
+        "index.d.ts",
+        "index.test-d.ts"
+    ]
+}

package/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Tue, 28 Oct 2025 17:37:26 GMT
+ * Last updated: Tue, 11 Nov 2025 23:33:13 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/node/console.d.ts

@@ -431,9 +431,10 @@ declare module "node:console" {
                 colorMode?: boolean | "auto" | undefined;
                 /**
                  * Specifies options that are passed along to
-                 * [`util.inspect()`](https://nodejs.org/docs/latest-v24.x/api/util.html#utilinspectobject-options).
+                 * `util.inspect()`. Can be an options object or, if different options
+                 * for stdout and stderr are desired, a `Map` from stream objects to options.
                  */
-                inspectOptions?: InspectOptions | undefined;
+                inspectOptions?: InspectOptions | ReadonlyMap<NodeJS.WritableStream, InspectOptions> | undefined;
                 /**
                  * Set group indentation.
                  * @default 2

package/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "24.9.2",
+    "version": "24.10.1",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~7.16.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "7485e2b36dbca4bd6584c40d09cac326c54ac8847561c62753f014789000ec21",
+    "typesPublisherContentHash": "bf541e42e173a984f57b649839d3371001c98469b0e8944f7762074aed2acd2f",
     "typeScriptVersion": "5.2"
 }

package/node_modules/@types/node/process.d.ts

@@ -1969,6 +1969,7 @@ declare module "process" {
                 addListener(event: "unhandledRejection", listener: UnhandledRejectionListener): this;
                 addListener(event: "warning", listener: WarningListener): this;
                 addListener(event: "message", listener: MessageListener): this;
+                addListener(event: "workerMessage", listener: (value: any, source: number) => void): this;
                 addListener(event: Signals, listener: SignalsListener): this;
                 addListener(event: "multipleResolves", listener: MultipleResolveListener): this;
                 addListener(event: "worker", listener: WorkerListener): this;
@@ -1981,6 +1982,7 @@ declare module "process" {
                 emit(event: "unhandledRejection", reason: unknown, promise: Promise<unknown>): boolean;
                 emit(event: "warning", warning: Error): boolean;
                 emit(event: "message", message: unknown, sendHandle: SendHandle): this;
+                emit(event: "workerMessage", value: any, source: number): this;
                 emit(event: Signals, signal?: Signals): boolean;
                 emit(
                     event: "multipleResolves",
@@ -1998,6 +2000,7 @@ declare module "process" {
                 on(event: "unhandledRejection", listener: UnhandledRejectionListener): this;
                 on(event: "warning", listener: WarningListener): this;
                 on(event: "message", listener: MessageListener): this;
+                on(event: "workerMessage", listener: (value: any, source: number) => void): this;
                 on(event: Signals, listener: SignalsListener): this;
                 on(event: "multipleResolves", listener: MultipleResolveListener): this;
                 on(event: "worker", listener: WorkerListener): this;
@@ -2011,6 +2014,7 @@ declare module "process" {
                 once(event: "unhandledRejection", listener: UnhandledRejectionListener): this;
                 once(event: "warning", listener: WarningListener): this;
                 once(event: "message", listener: MessageListener): this;
+                once(event: "workerMessage", listener: (value: any, source: number) => void): this;
                 once(event: Signals, listener: SignalsListener): this;
                 once(event: "multipleResolves", listener: MultipleResolveListener): this;
                 once(event: "worker", listener: WorkerListener): this;
@@ -2024,6 +2028,7 @@ declare module "process" {
                 prependListener(event: "unhandledRejection", listener: UnhandledRejectionListener): this;
                 prependListener(event: "warning", listener: WarningListener): this;
                 prependListener(event: "message", listener: MessageListener): this;
+                prependListener(event: "workerMessage", listener: (value: any, source: number) => void): this;
                 prependListener(event: Signals, listener: SignalsListener): this;
                 prependListener(event: "multipleResolves", listener: MultipleResolveListener): this;
                 prependListener(event: "worker", listener: WorkerListener): this;
@@ -2036,6 +2041,7 @@ declare module "process" {
                 prependOnceListener(event: "unhandledRejection", listener: UnhandledRejectionListener): this;
                 prependOnceListener(event: "warning", listener: WarningListener): this;
                 prependOnceListener(event: "message", listener: MessageListener): this;
+                prependOnceListener(event: "workerMessage", listener: (value: any, source: number) => void): this;
                 prependOnceListener(event: Signals, listener: SignalsListener): this;
                 prependOnceListener(event: "multipleResolves", listener: MultipleResolveListener): this;
                 prependOnceListener(event: "worker", listener: WorkerListener): this;
@@ -2048,6 +2054,7 @@ declare module "process" {
                 listeners(event: "unhandledRejection"): UnhandledRejectionListener[];
                 listeners(event: "warning"): WarningListener[];
                 listeners(event: "message"): MessageListener[];
+                listeners(event: "workerMessage"): ((value: any, source: number) => void)[];
                 listeners(event: Signals): SignalsListener[];
                 listeners(event: "multipleResolves"): MultipleResolveListener[];
                 listeners(event: "worker"): WorkerListener[];

package/node_modules/@types/node/sqlite.d.ts

@@ -329,6 +329,64 @@ declare module "node:sqlite" {
             func: (...args: SQLOutputValue[]) => SQLInputValue,
         ): void;
         function(name: string, func: (...args: SQLOutputValue[]) => SQLInputValue): void;
+        /**
+         * Sets an authorizer callback that SQLite will invoke whenever it attempts to
+         * access data or modify the database schema through prepared statements.
+         * This can be used to implement security policies, audit access, or restrict certain operations.
+         * This method is a wrapper around [`sqlite3_set_authorizer()`](https://sqlite.org/c3ref/set_authorizer.html).
+         *
+         * When invoked, the callback receives five arguments:
+         *
+         * * `actionCode` {number} The type of operation being performed (e.g.,
+         *   `SQLITE_INSERT`, `SQLITE_UPDATE`, `SQLITE_SELECT`).
+         * * `arg1` {string|null} The first argument (context-dependent, often a table name).
+         * * `arg2` {string|null} The second argument (context-dependent, often a column name).
+         * * `dbName` {string|null} The name of the database.
+         * * `triggerOrView` {string|null} The name of the trigger or view causing the access.
+         *
+         * The callback must return one of the following constants:
+         *
+         * * `SQLITE_OK` - Allow the operation.
+         * * `SQLITE_DENY` - Deny the operation (causes an error).
+         * * `SQLITE_IGNORE` - Ignore the operation (silently skip).
+         *
+         * ```js
+         * import { DatabaseSync, constants } from 'node:sqlite';
+         * const db = new DatabaseSync(':memory:');
+         *
+         * // Set up an authorizer that denies all table creation
+         * db.setAuthorizer((actionCode) => {
+         *   if (actionCode === constants.SQLITE_CREATE_TABLE) {
+         *     return constants.SQLITE_DENY;
+         *   }
+         *   return constants.SQLITE_OK;
+         * });
+         *
+         * // This will work
+         * db.prepare('SELECT 1').get();
+         *
+         * // This will throw an error due to authorization denial
+         * try {
+         *   db.exec('CREATE TABLE blocked (id INTEGER)');
+         * } catch (err) {
+         *   console.log('Operation blocked:', err.message);
+         * }
+         * ```
+         * @since v24.10.0
+         * @param callback The authorizer function to set, or `null` to
+         * clear the current authorizer.
+         */
+        setAuthorizer(
+            callback:
+                | ((
+                    actionCode: number,
+                    arg1: string | null,
+                    arg2: string | null,
+                    dbName: string | null,
+                    triggerOrView: string | null,
+                ) => number)
+                | null,
+        ): void;
         /**
          * Whether the database is currently open or not.
          * @since v22.15.0
@@ -826,5 +884,54 @@ declare module "node:sqlite" {
          * @since v22.12.0
          */
         const SQLITE_CHANGESET_ABORT: number;
+        /**
+         * Deny the operation and cause an error to be returned.
+         * @since v24.10.0
+         */
+        const SQLITE_DENY: number;
+        /**
+         * Ignore the operation and continue as if it had never been requested.
+         * @since 24.10.0
+         */
+        const SQLITE_IGNORE: number;
+        /**
+         * Allow the operation to proceed normally.
+         * @since v24.10.0
+         */
+        const SQLITE_OK: number;
+        const SQLITE_CREATE_INDEX: number;
+        const SQLITE_CREATE_TABLE: number;
+        const SQLITE_CREATE_TEMP_INDEX: number;
+        const SQLITE_CREATE_TEMP_TABLE: number;
+        const SQLITE_CREATE_TEMP_TRIGGER: number;
+        const SQLITE_CREATE_TEMP_VIEW: number;
+        const SQLITE_CREATE_TRIGGER: number;
+        const SQLITE_CREATE_VIEW: number;
+        const SQLITE_DELETE: number;
+        const SQLITE_DROP_INDEX: number;
+        const SQLITE_DROP_TABLE: number;
+        const SQLITE_DROP_TEMP_INDEX: number;
+        const SQLITE_DROP_TEMP_TABLE: number;
+        const SQLITE_DROP_TEMP_TRIGGER: number;
+        const SQLITE_DROP_TEMP_VIEW: number;
+        const SQLITE_DROP_TRIGGER: number;
+        const SQLITE_DROP_VIEW: number;
+        const SQLITE_INSERT: number;
+        const SQLITE_PRAGMA: number;
+        const SQLITE_READ: number;
+        const SQLITE_SELECT: number;
+        const SQLITE_TRANSACTION: number;
+        const SQLITE_UPDATE: number;
+        const SQLITE_ATTACH: number;
+        const SQLITE_DETACH: number;
+        const SQLITE_ALTER_TABLE: number;
+        const SQLITE_REINDEX: number;
+        const SQLITE_ANALYZE: number;
+        const SQLITE_CREATE_VTABLE: number;
+        const SQLITE_DROP_VTABLE: number;
+        const SQLITE_FUNCTION: number;
+        const SQLITE_SAVEPOINT: number;
+        const SQLITE_COPY: number;
+        const SQLITE_RECURSIVE: number;
     }
 }

package/node_modules/@types/node/url.d.ts

@@ -71,20 +71,44 @@ declare module "url" {
      * A `URIError` is thrown if the `auth` property is present but cannot be decoded.
      *
      * `url.parse()` uses a lenient, non-standard algorithm for parsing URL
-     * strings. It is prone to security issues such as [host name spoofing](https://hackerone.com/reports/678487) and incorrect handling of usernames and passwords. Do not use with untrusted
-     * input. CVEs are not issued for `url.parse()` vulnerabilities. Use the `WHATWG URL` API instead.
+     * strings. It is prone to security issues such as [host name spoofing](https://hackerone.com/reports/678487)
+     * and incorrect handling of usernames and passwords. Do not use with untrusted
+     * input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
+     * [WHATWG URL](https://nodejs.org/docs/latest-v24.x/api/url.html#the-whatwg-url-api) API instead, for example:
+     *
+     * ```js
+     * function getURL(req) {
+     *   const proto = req.headers['x-forwarded-proto'] || 'https';
+     *   const host = req.headers['x-forwarded-host'] || req.headers.host || 'example.com';
+     *   return new URL(req.url || '/', `${proto}://${host}`);
+     * }
+     * ```
+     *
+     * The example above assumes well-formed headers are forwarded from a reverse
+     * proxy to your Node.js server. If you are not using a reverse proxy, you should
+     * use the example below:
+     *
+     * ```js
+     * function getURL(req) {
+     *   return new URL(req.url || '/', 'https://example.com');
+     * }
+     * ```
      * @since v0.1.25
      * @deprecated Use the WHATWG URL API instead.
      * @param urlString The URL string to parse.
-     * @param [parseQueryString=false] If `true`, the `query` property will always be set to an object returned by the {@link querystring} module's `parse()` method. If `false`, the `query` property
-     * on the returned URL object will be an unparsed, undecoded string.
-     * @param [slashesDenoteHost=false] If `true`, the first token after the literal string `//` and preceding the next `/` will be interpreted as the `host`. For instance, given `//foo/bar`, the
-     * result would be `{host: 'foo', pathname: '/bar'}` rather than `{pathname: '//foo/bar'}`.
+     * @param parseQueryString If `true`, the `query` property will always
+     * be set to an object returned by the [`querystring`](https://nodejs.org/docs/latest-v24.x/api/querystring.html) module's `parse()`
+     * method. If `false`, the `query` property on the returned URL object will be an
+     * unparsed, undecoded string. **Default:** `false`.
+     * @param slashesDenoteHost If `true`, the first token after the literal
+     * string `//` and preceding the next `/` will be interpreted as the `host`.
+     * For instance, given `//foo/bar`, the result would be
+     * `{host: 'foo', pathname: '/bar'}` rather than `{pathname: '//foo/bar'}`.
+     * **Default:** `false`.
      */
-    function parse(urlString: string): UrlWithStringQuery;
     function parse(
         urlString: string,
-        parseQueryString: false | undefined,
+        parseQueryString?: false,
         slashesDenoteHost?: boolean,
     ): UrlWithStringQuery;
     function parse(urlString: string, parseQueryString: true, slashesDenoteHost?: boolean): UrlWithParsedQuery;

package/node_modules/axios/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.13.2](https://github.com/axios/axios/compare/v1.13.1...v1.13.2) (2025-11-04)
+
+
+### Bug Fixes
+
+* **http:** fix 'socket hang up' bug for keep-alive requests when using timeouts; ([#7206](https://github.com/axios/axios/issues/7206)) ([8d37233](https://github.com/axios/axios/commit/8d372335f5c50ecd01e8615f2468a9eb19703117))
+* **http:** use default export for http2 module to support stubs; ([#7196](https://github.com/axios/axios/issues/7196)) ([0588880](https://github.com/axios/axios/commit/0588880ac7ddba7594ef179930493884b7e90bf5))
+
+
+### Performance Improvements
+
+* **http:** fix early loop exit; ([#7202](https://github.com/axios/axios/issues/7202)) ([12c314b](https://github.com/axios/axios/commit/12c314b603e7852a157e93e47edb626a471ba6c5))
+
+### Contributors to this release
+
+- <img src="https://avatars.githubusercontent.com/u/12586868?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Dmitriy Mozgovoy](https://github.com/DigitalBrainJS "+28/-9 (#7206 #7202 )")
+- <img src="https://avatars.githubusercontent.com/u/1174718?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Kasper Isager Dalsgarð](https://github.com/kasperisager "+9/-9 (#7196 )")
+
 ## [1.13.1](https://github.com/axios/axios/compare/v1.13.0...v1.13.1) (2025-10-28)