@newrelic/security-agent 2.4.2 → 2.4.3

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+### v2.4.3 (2025-07-23)
+#### Bug fixes
+* Removed dependency sync-req and updated axios
+
 ### v2.4.2 (2025-05-14)
 #### Bug fixes
 * Fixed usage of incorrect method
@@ -7,21 +11,21 @@
 * Only listen once for uncaughtException
 #### Miscellaneous chores
 * (deps-dev): bump koa from v2.14.2 to v2.16.1
-* (deps-dev): bump tar-fs from v2.1.1 to v2.1.2 
+* (deps-dev): bump tar-fs from v2.1.1 to v2.1.2
 
 
 ### v2.4.0 (2025-03-21)
 #### Features
 * Support for gRPC error reporting
-* Support to detect API endpoints in next.js framework 
+* Support to detect API endpoints in next.js framework
 #### Miscellaneous chores
 * Updated axios to v1.8.4
 
 ### v2.3.2 (2025-03-11)
 #### Bug fixes
-* Updated axios to v1.8.2 
+* Updated axios to v1.8.2
 #### Miscellaneous chores
-* Updated readme 
+* Updated readme
 
 
 ### v2.3.1 (2025-02-04)
@@ -33,20 +37,20 @@
 #### Features
 * Added Support for VM module
 * IAST support for Next.js
-* Support for Insecure settings i.e crypto, hash and random modules 
+* Support for Insecure settings i.e crypto, hash and random modules
 
 #### Bug fixes
 * Fix for special characters in ws header
-* Fix for getting transaction in graphql instrumentation 
-* Fix for mongodb unit tests 
+* Fix for getting transaction in graphql instrumentation
+* Fix for mongodb unit tests
 
 #### Miscellaneous chores
 * deps-dev: bump undici from v5.28.4 to v5.28.5
-* Updated axios to v1.7.9 
+* Updated axios to v1.7.9
 
 ### v2.2.0 (2024-12-18)
 #### Features
-* Support for express 5.x 
+* Support for express 5.x
 * IAST support for GraphQL
 * Added support for trustboundary security events
 
@@ -55,7 +59,7 @@
 
 ### v2.1.1 (2024-11-07)
 #### Bug fixes
-* Fix for assignment to logger constant 
+* Fix for assignment to logger constant
 
 ### v2.1.0 (2024-11-05)
 #### Features
@@ -65,7 +69,7 @@
 * Added default values for scan_schedule, scan_controllers and exclude_from_iast_scan config
 * Fix for security home placeholder replacement in fuzz requests
 * Handling to not resolve file path in fs module instrumentation
-* Fix for batch size and condition of iast-data-request sending 
+* Fix for batch size and condition of iast-data-request sending
 #### Miscellaneous chores
 * Added requestURI field in http request for application-runtime-error
 * Updated instrumented to get the transaction directly instead of from the active segment
@@ -94,7 +98,7 @@
 #### Bug fixes
 * Fix for traceId in error reporting
 #### Miscellaneous chores
-* (deps): bumped axios from 1.6.8 to 1.7.4 
+* (deps): bumped axios from 1.6.8 to 1.7.4
 * (deps-dev): bumped ws from 7.5.9 to 8.18.0
 #### Continuous integration
 * Added Node.js v22.x to unit tests
@@ -102,26 +106,26 @@
 ### v1.4.0 (2024-06-24)
 #### Features
 * Added support to report application's errors while IAST scanning
-* Support to detect gRPC API endpoints 
+* Support to detect gRPC API endpoints
 #### Bug fixes
 * Remove additional headers added by IAST client
-* Fix for uncaught exception reporting 
+* Fix for uncaught exception reporting
 #### Miscellaneous chores
-* Updated package.json to bump ws from 8.14.2 to 8.17.1 
-* (deps-dev): bump @grpc/grpc-js from 1.9.12 to 1.10.9 
+* Updated package.json to bump ws from 8.14.2 to 8.17.1
+* (deps-dev): bump @grpc/grpc-js from 1.9.12 to 1.10.9
 * (deps-dev): bump braces from 3.0.2 to 3.0.3
-* (deps): bump ws from 8.14.2 to 8.17.1 
+* (deps): bump ws from 8.14.2 to 8.17.1
 
 ### v1.3.0 (2024-05-31)
 #### Features
 * Added route field in security event for API endpoint mapping
 #### Bug fixes
-* Fix for control commands acknowledgement in security agent 
-* Added assert for typeof response data in Reflected XSS validation 
-* Updated @grpc/grpc-js instrumentation to instrument submodules 
+* Fix for control commands acknowledgement in security agent
+* Added assert for typeof response data in Reflected XSS validation
+* Updated @grpc/grpc-js instrumentation to instrument submodules
 * Handling to convert header values into string
 #### Miscellaneous chores
-* Updated log level for critical messages 
+* Updated log level for critical messages
 * Readme update
 * (deps-dev): bump axios from 0.21.4 to 1.7.2
 
@@ -129,7 +133,7 @@
 #### Features
 * Added instrumentation for express framework's res.download() and res.sendFile()
 #### Bug fixes
-* Handling to decrypt fuzz header data for IAST scanning 
+* Handling to decrypt fuzz header data for IAST scanning
 * Logging and snapshot file fixes
 #### Miscellaneous chores
 * Prepend vulnerability case type with apiId
@@ -142,13 +146,13 @@
 
 ### v1.1.0 (2024-03-19)
 #### Features
-* IAST support for grpc 
+* IAST support for grpc
 * Functionality to report API endpoints of the application
 * IAST support for undici
 #### Bug fixes
 * Updated permissions for file/directory created by security agent
 #### Miscellaneous chores
-* Bumped follow-redirects from v1.15.2 to v1.15.4  
+* Bumped follow-redirects from v1.15.2 to v1.15.4
 * Updated axios to v1.6.8
 * Bumped ip from v2.0.0 to v2.0.1
 * Bumped undici from 5.28.2 to v5.28.3
@@ -156,7 +160,7 @@
 
 ### v1.0.1 (2024-02-07)
 #### Bug fixes
-* Reporting of framework in security event json 
+* Reporting of framework in security event json
 #### Miscellaneous chores
 * Updated software license to New Relic Software License Version 1.0
 * Ability to send critical messages on successful startup of agent
@@ -173,8 +177,8 @@
 #### Miscellaneous chores
 * Updated log event jsonName to "critical-messages"
 * Removed dependency @aws-sdk/client-lambda
-* Bumped follow-redirects from v1.15.2 to v1.15.4  
-* Upgraded axios to v1.6.5 
+* Bumped follow-redirects from v1.15.2 to v1.15.4
+* Upgraded axios to v1.6.5
 
 ### v0.6.0 (2024-01-03)
 #### Features
@@ -186,7 +190,7 @@
 * Fix for honouring probing interval from policy
 #### Miscellaneous chores
 * Added nestjs test cases
-* Additional logging for instrumented modules and methods 
+* Additional logging for instrumented modules and methods
 * Upgraded axios to v1.6.3
 * Removed pinned version for axios and check-disk-space
 * Update in lockfileVersion of package-lock.json
@@ -207,10 +211,10 @@
 
 ### v0.4.0 (2023-10-27)
 #### Features
-* Added event stats for RASP, IAST and exit events in healthcheck. 
+* Added event stats for RASP, IAST and exit events in healthcheck.
 #### Miscellaneous chores
 * Deps: Updated uuid to v9.0.1 and @aws-sdk/client-lambda to v3.405.0
-* Upgraded axios to 1.6.0 to resolve CVE-2023-45857 
+* Upgraded axios to 1.6.0 to resolve CVE-2023-45857
 #### Continuous integration
 * Removed Node.js 14.x from CI.
 * Added should_skip flag to skip CI based on label.

package/THIRD_PARTY_NOTICES.md

@@ -32,7 +32,6 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 * [request-ip](#request-ip)
 * [ringbufferjs](#ringbufferjs)
 * [semver](#semver)
-* [sync-request](#sync-request)
 * [unescape-js](#unescape-js)
 * [unescape](#unescape)
 * [uuid](#uuid)
@@ -78,7 +77,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.8.4](https://github.com/axios/axios/tree/v1.8.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.8.4/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.11.0](https://github.com/axios/axios/tree/v1.11.0)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.11.0/LICENSE):
 
 ```
 # Copyright (c) 2014-present Matt Zabriskie & Collaborators
@@ -532,32 +531,6 @@ IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ```
 
-### sync-request
-
-This product includes source derived from [sync-request](https://github.com/ForbesLindesay/sync-request) ([v6.1.0](https://github.com/ForbesLindesay/sync-request/tree/v6.1.0)), distributed under the [MIT License](https://github.com/ForbesLindesay/sync-request/blob/v6.1.0/LICENSE):
-
-```
-Copyright (c) 2014 Forbes Lindesay
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-```
-
 ### unescape-js
 
 This product includes source derived from [unescape-js](https://github.com/iamakulov/unescape-js) ([v1.1.4](https://github.com/iamakulov/unescape-js/tree/v1.1.4)), distributed under the [MIT License](https://github.com/iamakulov/unescape-js/blob/v1.1.4/LICENSE):

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -138,7 +138,7 @@ function ApplicationInfo () {
             ? `${process.env[AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER]}:${lambdaVersion}`
             : `${lambdaARN}:${lambdaVersion}`;
         this.identifier.lambdaAWSSessionToken = process.env[AWS_SESSION_TOKEN_ENV_IDENTIFIER];
-        
+
     } else {
         this.identifier.kind = "HOST";
         this.identifier.envInfo = setHostProperties();
@@ -482,42 +482,9 @@ function getECSTaskId () {
 
 function populateECSInfo (ecsObj) {
     ecsObj.ecsTaskId = getECSTaskId();
-    const ecsData = getECSInfo();
-    if (!_.isEmpty(ecsData)) {
-        const imageId = ecsData.ImageID;
-        const imageName = ecsData.Image;
-
-        ecsObj.imageId = imageId;
-        ecsObj.imageName = imageName;
-
-        const labels = ecsData.Labels;
-
-        if (!_.isEmpty(labels)) {
-            const containerName = labels['com.amazonaws.ecs.container-name'];
-            const ecsTaskDefinitionFamily = labels['com.amazonaws.ecs.task-definition-family'];
-            const ecsTaskDefinitionVersion = labels['com.amazonaws.ecs.task-definition-version'];
-
-            ecsObj.containerName = containerName;
-            if (ecsTaskDefinitionFamily && ecsTaskDefinitionVersion) {
-                ecsObj.ecsTaskDefinition = ecsTaskDefinitionFamily + ':' + ecsTaskDefinitionVersion;
-            }
-        }
-    }
     return ecsObj;
 }
 
-function getECSInfo () {
-    const url = process.env.ECS_CONTAINER_METADATA_URI;
-    let json = {};
-    const request = require('sync-request');
-    try {
-        const res = request('GET', url);
-        const body = res.getBody();
-        json = JSON.parse(body);
-    } catch (error) {
-    }
-    return json;
-}
 
 function getApplicationSHAAndSizeFromWorker (applicationInfo, applicationPath) {
     const { Worker } = require('worker_threads');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.2.9",
@@ -39,7 +39,7 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "axios": "^1.8.4",
+    "axios": "^1.11.0",
     "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "cron": "^3.1.7",
@@ -57,7 +57,6 @@
     "request-ip": "^3.3.0",
     "ringbufferjs": "^2.0.0",
     "semver": "^7.5.4",
-    "sync-request": "^6.1.0",
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
     "uuid": "^9.0.1",