@contrast/agent 5.0.0 → 5.0.2

package/README.md

@@ -1,7 +1,7 @@
 # Contrast Security Node.js Agent
 
 This package will enable instrumentation of your Node.js application for
-security anaylsis and runtime protection by [Contrast Security](https://www.contrastsecurity.com).
+security analysis and runtime protection by [Contrast Security](https://www.contrastsecurity.com).
 
 Unlike legacy application security testing solutions, Contrast produces accurate
 results without dependence on application security experts. Accuracy comes from

package/lib/esm-loader.mjs

@@ -139,6 +139,16 @@ if (Module.register && flag === '--import') {
   // get relative URL
   const url = new URL('./esm-hooks.mjs', import.meta.url);
   await Module.register(url.href, import.meta.url, { data: { port: port2 }, transferList: [port2] });
+
+  // we only need to do this if there is a background thread.
+  // The esmHooks component of the main agent will send TS settings update to the loader agent via the port.
+  // To get the loader agent components to update we just need to forward the settings using `.messages` emitter.
+  core.messages.on(Event.SERVER_SETTINGS_UPDATE, (msg) => {
+    core.threadInfo.port.postMessage({
+      type: Event.SERVER_SETTINGS_UPDATE,
+      ...msg,
+    });
+  });
 }
 
 // it's not possible to conditionally export, but exporting undefined

package/lib/initialize.mjs

@@ -122,11 +122,13 @@ async function executor(core) {
   };
 
   core.npmVersionRange = npmEngine;
-  require('@contrast/assess')(core);
-  require('@contrast/architecture-components')(core);
-  require('@contrast/library-analysis')(core);
-  require('@contrast/route-coverage')(core);
-  require('@contrast/protect')(core); // protect loads last; the other features are all passive
+  if (isMainThread) {
+    require('@contrast/assess')(core);
+    require('@contrast/architecture-components')(core);
+    require('@contrast/library-analysis')(core);
+    require('@contrast/route-coverage')(core);
+    require('@contrast/protect')(core); // protect loads last; the other features are all passive
+  }
 
   return core; // should this return core or just null/undefined?
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "5.0.0",
+  "version": "5.0.2",
   "description": "Assess and Protect agents for Node.js",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,13 +21,13 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agentify": "1.18.0",
+    "@contrast/agentify": "1.18.2",
     "@contrast/architecture-components": "1.14.0",
-    "@contrast/assess": "1.20.0",
+    "@contrast/assess": "1.20.1",
     "@contrast/library-analysis": "1.15.1",
-    "@contrast/protect": "1.30.0",
+    "@contrast/protect": "1.30.1",
     "@contrast/route-coverage": "1.14.0",
-    "@contrast/telemetry": "1.2.0",
+    "@contrast/telemetry": "1.2.1",
     "semver": "^7.3.7"
   }
 }