@zuplo/cli 7.9.14 → 7.9.16

package/node_modules/@posthog/core/dist/privacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.d.ts","sourceRoot":"","sources":["../src/privacy.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAqiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAKxF;AA6DD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAE/F"}
+{"version":3,"file":"privacy.d.ts","sourceRoot":"","sources":["../src/privacy.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AA2iBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAKxF;AA6DD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAE/F"}

package/node_modules/@posthog/core/dist/privacy.js

@@ -95,7 +95,10 @@ function sanitizeUrlFields(fields, allowNestedUrls) {
     const sanitized = new URLSearchParams();
     let changed = false;
     let lastFieldSensitive = false;
-    for (const [key, value] of new URLSearchParams(fields)){
+    for (const [decodedKey, decodedValue] of new URLSearchParams(fields)){
+        const key = redactCredentials(decodedKey);
+        const value = redactCredentials(decodedValue);
+        changed ||= key !== decodedKey || value !== decodedValue;
         const sanitizedValue = sanitizeUrlFieldValue(key, value, allowNestedUrls);
         changed ||= sanitizedValue !== value;
         lastFieldSensitive = shouldRedactQueryKey(key) || sanitizedValue !== value;
@@ -237,7 +240,7 @@ function sanitizeSingleUrl(value, mode) {
         changed = true;
     }
     const trailingFields = hasFragment ? sanitizedTail ?? sanitizedHead : sanitizedQuery;
-    return (changed ? url.toString() : address) + (trailingFields.lastFieldSensitive ? '' : suffix);
+    return (changed ? redactCredentials(url.toString()) : address) + (trailingFields.lastFieldSensitive ? '' : suffix);
 }
 function sanitizeUrlsInString(text, mode) {
     return text.replace(URL_PATTERN, (match)=>sanitizeUrl(match, {

package/node_modules/@posthog/core/dist/privacy.mjs

@@ -66,7 +66,10 @@ function sanitizeUrlFields(fields, allowNestedUrls) {
     const sanitized = new URLSearchParams();
     let changed = false;
     let lastFieldSensitive = false;
-    for (const [key, value] of new URLSearchParams(fields)){
+    for (const [decodedKey, decodedValue] of new URLSearchParams(fields)){
+        const key = redactCredentials(decodedKey);
+        const value = redactCredentials(decodedValue);
+        changed ||= key !== decodedKey || value !== decodedValue;
         const sanitizedValue = sanitizeUrlFieldValue(key, value, allowNestedUrls);
         changed ||= sanitizedValue !== value;
         lastFieldSensitive = shouldRedactQueryKey(key) || sanitizedValue !== value;
@@ -208,7 +211,7 @@ function sanitizeSingleUrl(value, mode) {
         changed = true;
     }
     const trailingFields = hasFragment ? sanitizedTail ?? sanitizedHead : sanitizedQuery;
-    return (changed ? url.toString() : address) + (trailingFields.lastFieldSensitive ? '' : suffix);
+    return (changed ? redactCredentials(url.toString()) : address) + (trailingFields.lastFieldSensitive ? '' : suffix);
 }
 function sanitizeUrlsInString(text, mode) {
     return text.replace(URL_PATTERN, (match)=>sanitizeUrl(match, {

package/node_modules/@posthog/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/core",
-  "version": "1.57.0",
+  "version": "1.57.2",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -34,6 +34,7 @@
   },
   "files": [
     "dist",
+    "surveys",
     "src",
     "!src/__tests__"
   ],
@@ -70,7 +71,7 @@
     }
   },
   "dependencies": {
-    "@posthog/types": "^1.415.0"
+    "@posthog/types": "^1.415.1"
   },
   "devDependencies": {
     "@rslib/core": "0.23.2",

package/node_modules/@posthog/core/src/privacy.ts

@@ -209,7 +209,12 @@ function sanitizeUrlFields(
   const sanitized = new URLSearchParams()
   let changed = false
   let lastFieldSensitive = false
-  for (const [key, value] of new URLSearchParams(fields)) {
+  // Parsing decodes each field, which can turn an encoded PostHog token
+  // (`%70hx_...`) into a plain one, so tokens are redacted again after decoding.
+  for (const [decodedKey, decodedValue] of new URLSearchParams(fields)) {
+    const key = redactCredentials(decodedKey)
+    const value = redactCredentials(decodedValue)
+    changed ||= key !== decodedKey || value !== decodedValue
     const sanitizedValue = sanitizeUrlFieldValue(key, value, allowNestedUrls)
     // `changed` is compared, not inferred from the key: the PostHog-token pass
     // runs first, so a value can already read `[redacted]`, and calling that a
@@ -479,7 +484,8 @@ function sanitizeSingleUrl(value: string, mode: UrlSanitizeMode): string {
   // with it; losing a comma from the surrounding prose is the accepted cost of
   // not shipping `!!!`.
   const trailingFields = hasFragment ? (sanitizedTail ?? sanitizedHead) : sanitizedQuery
-  return (changed ? url.toString() : address) + (trailingFields.lastFieldSensitive ? '' : suffix)
+  // Serializing writes the host decoded, which can expose an encoded PostHog token.
+  return (changed ? redactCredentials(url.toString()) : address) + (trailingFields.lastFieldSensitive ? '' : suffix)
 }
 
 /**

package/node_modules/@posthog/core/surveys/package.json

@@ -0,0 +1,6 @@
+{
+  "private": true,
+  "main": "../dist/surveys/index.js",
+  "module": "../dist/surveys/index.mjs",
+  "types": "../dist/surveys/index.d.ts"
+}

package/node_modules/@zuplo/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/core",
-  "version": "7.9.14",
+  "version": "7.9.16",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",

package/node_modules/@zuplo/graphql/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/graphql",
   "type": "module",
-  "version": "7.9.14",
+  "version": "7.9.16",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/@zuplo/openapi-tools/package.json

@@ -2,7 +2,7 @@
   "name": "@zuplo/openapi-tools",
   "type": "module",
   "sideEffects": false,
-  "version": "7.9.14",
+  "version": "7.9.16",
   "description": "Tooling for OpenAPI files",
   "repository": {
     "type": "git",

package/node_modules/@zuplo/otel/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/otel",
   "type": "module",
-  "version": "7.9.14",
+  "version": "7.9.16",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {