newrelic 3.3.1 → 4.0.0

package/.travis.yml

@@ -1,7 +1,5 @@
 language: node_js
 node_js:
-  - "0.10"
-  - "0.12"
   - "4"
   - "5"
   - "6"
@@ -18,14 +16,6 @@ env:
   - SUITE=versioned
 matrix:
   exclude:
-    - node_js: "0.10"
-      env: SUITE=security
-    - node_js: "0.10"
-      env: SUITE=lint
-    - node_js: "0.12"
-      env: SUITE=security
-    - node_js: "0.12"
-      env: SUITE=lint
     - node_js: "4"
       env: SUITE=security
     - node_js: "4"

package/Migration Guide.md

@@ -3,6 +3,18 @@
 This guide is intended to help with upgrading major versions of the Node Agent.
 This information can also be found on [our documentation website][upgrade-doc].
 
+## Upgrading to Agent v4
+
+### Breaking Changes
+
+**Upgraded https-proxy-agent from v0 to v2**: This dependency has been updated
+due to a security issue in the version of `https-proxy-agent` the New Relic Node.js
+agent used. `https-proxy` v2 is incompatible with node v0.10 and v0.12,
+requiring deprecation of those versions for the agent. There is no required
+action to migrate from v3 to v4 of New Relic's Node.js agent.
+
+--------------------------------------------------------------------------------
+
 ## Upgrading to Agent v3
 
 ### Breaking Changes

package/NEWS.md

@@ -1,3 +1,19 @@
+### 4.0.0 (2018-04-12):
+
+* BREAKING: Updated the version of `https-proxy-agent` to v2.x - Dropped support for v0.10 and v0.12 of node.
+
+  The version of `https-proxy-agent` used in the agent has a known security
+  issue you can read about here: https://snyk.io/vuln/npm:https-proxy-agent:20180402
+  In order to resolve this issue, the dependency had to be updated to at least
+  v2.2.0, which only supported node versions >=4.  The update to this dependency
+  forces the incompatibility of the agent with versions 0.10 and 0.12 of node.
+
+  In order to use use the Node.js agent, please upgrade node to version >=4, or you can
+  continue to use the agent on node versions 0.10 and 0.12 by pinning the agent
+  to v3.
+
+  You can read more about the issue here: https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security-bulletins/security-bulletin-nr18-08
+
 ### 3.3.1 (2018-04-10):
 
 * Added a type check to attribute validation, restricting values to primitive types

package/index.js

@@ -42,10 +42,10 @@ function initialize() {
       preAgentTime
     )
 
-    // TODO: Update this check when Node v0.10 is deprecated.
-    if (psemver.satisfies('<0.10.0')) {
+    // TODO: Update this check when Node v4 is deprecated.
+    if (psemver.satisfies('<4.0.0')) {
       message = "New Relic for Node.js requires a version of Node equal to or\n" +
-                "greater than 0.10.0. Not starting!"
+                "greater than 4.0.0. Not starting!"
 
       logger.error(message)
       throw new Error(message)

package/lib/instrumentation/core/http.js

@@ -633,7 +633,12 @@ module.exports = function initialize(agent, http, moduleName) {
       wrapRequest.bind(null, agent)
     )
 
-    if (psemver.satisfies('>=8')) {
+    // Upon updating to https-proxy-agent v2, we are now using
+    // agent-base v4, which patches https.get to use https.request.
+    // https://github.com/TooTallNate/node-agent-base/commit/7de92df780e147d46185281d26a1b534b3aaa97e
+    // This means we need to skip instrumenting to avoid double
+    // instrumenting external requests.
+    if (moduleName !== 'https' && psemver.satisfies('>=8')) {
       shimmer.wrapMethod(
         http,
         'http',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "newrelic",
-  "version": "3.3.1",
+  "version": "4.0.0",
   "author": "New Relic Node.js agent team <nodejs@newrelic.com>",
   "licenses": [
     {
@@ -96,7 +96,7 @@
   ],
   "homepage": "http://github.com/newrelic/node-newrelic",
   "engines": {
-    "node": ">=0.10.0",
+    "node": ">=4.0.0",
     "npm": ">=2.0.0"
   },
   "directories": {
@@ -114,7 +114,7 @@
     "@newrelic/koa": "^1.0.0",
     "async": "^2.1.4",
     "concat-stream": "^1.5.0",
-    "https-proxy-agent": "^0.3.6",
+    "https-proxy-agent": "^2.2.1",
     "json-stringify-safe": "^5.0.0",
     "readable-stream": "^2.1.4",
     "semver": "^5.3.0"