postman-runtime 7.40.0-beta.1 → 7.41.0

package/lib/backpack/index.js

@@ -116,7 +116,7 @@ module.exports = backpack = {
             // if any flag is not defined, we exit. when all flags hold a value, we know that the end callback has to be
             // executed.
             for (var i = 0, ii = flags.length; i < ii; i++) {
-                if (!Object.hasOwnProperty.call(status, flags[i])) { return; }
+                if (!Object.hasOwn(status, flags[i])) { return; }
             }
 
             sealed = true;

package/lib/requester/core-body-builder.js

@@ -102,7 +102,7 @@ urlEncodedBodyReducer = function (form, param) {
         value = param.value;
 
     // add the parameter to the form while accounting for duplicate values
-    if (!Object.hasOwnProperty.call(form, key)) {
+    if (!Object.hasOwn(form, key)) {
         form[key] = value;
 
         return form;
@@ -273,15 +273,15 @@ module.exports = {
         // stringified content. This avoids parsing the variables.
         body = [];
 
-        if (Object.hasOwnProperty.call(content, 'query') && (typeof content.query === STRING)) {
+        if (Object.hasOwn(content, 'query') && (typeof content.query === STRING)) {
             body.push('"query":' + JSON.stringify(content.query));
         }
 
-        if (Object.hasOwnProperty.call(content, 'operationName') && (typeof content.operationName === STRING)) {
+        if (Object.hasOwn(content, 'operationName') && (typeof content.operationName === STRING)) {
             body.push('"operationName":' + JSON.stringify(content.operationName));
         }
 
-        if (Object.hasOwnProperty.call(content, 'variables') && (typeof content.variables === STRING) &&
+        if (Object.hasOwn(content, 'variables') && (typeof content.variables === STRING) &&
             // even though users are free to send even malformed json string, the case of empty string has to be
             // specially disallowed since in most default cases if a text editor is used to accept this data, it will
             // send a blank string for an empty text-editor state and that would be an error flow. That implies majority

package/lib/requester/core.js

@@ -82,7 +82,10 @@ var dns = require('dns'),
 
         // removes the `referer` header when a redirect happens (default: false)
         // @note `referer` header set in the initial request will be preserved during redirect chain
-        removeRefererHeader: 'removeRefererHeaderOnRedirect'
+        removeRefererHeader: 'removeRefererHeaderOnRedirect',
+
+        // Select the HTTP protocol version to be used. Valid options are http1/http2/auto
+        protocolVersion: 'protocolVersion'
     },
 
     /**
@@ -173,7 +176,7 @@ var dns = require('dns'),
         });
 
         for (key in systemHeaders) {
-            if (Object.hasOwnProperty.call(systemHeaders, key)) {
+            if (Object.hasOwn(systemHeaders, key)) {
                 // upsert instead of add to replace user-defined headers also
                 headers.upsert({
                     key: key,
@@ -254,7 +257,7 @@ var dns = require('dns'),
 
             done = function (type) {
                 if (!called) {
-                    callback(type === S_CONNECT ? null : true); // eslint-disable-line callback-return
+                    callback(type === S_CONNECT ? null : true); // eslint-disable-line n/callback-return
                     called = true;
                     this.destroy();
                 }
@@ -375,7 +378,7 @@ var dns = require('dns'),
         // bail out if property or defaultOpts is not defined
         if (!(property && defaultOpts)) { return; }
 
-        if (Object.hasOwnProperty.call(protocolProfileBehavior, property)) {
+        if (Object.hasOwn(protocolProfileBehavior, property)) {
             return protocolProfileBehavior[property];
         }
 
@@ -399,6 +402,7 @@ module.exports = {
      * @param defaultOpts.followOriginalHttpMethod
      * @param defaultOpts.maxRedirects
      * @param defaultOpts.maxResponseSize
+     * @param defaultOpts.protocolVersion
      * @param defaultOpts.implicitCacheControl
      * @param defaultOpts.implicitTraceHeader
      * @param defaultOpts.removeRefererHeaderOnRedirect
@@ -665,7 +669,7 @@ module.exports = {
         //
         // @note if you'd like to support additional body types beyond formdata, url-encoding, etc, add the same to
         //       the builder module
-        if (!Object.hasOwnProperty.call(requestBodyBuilders, requestBodyType)) {
+        if (!Object.hasOwn(requestBodyBuilders, requestBodyType)) {
             return;
         }
 

package/lib/requester/request-wrapper.js

@@ -63,11 +63,6 @@ var _ = require('lodash'),
         cb(null, options);
     };
 
-// Enable support for extending root CAs.
-// Refer: https://github.com/postmanlabs/postman-request/pull/35
-// @todo trigger console warning (using callback) if not enabled.
-requests.enableNodeExtraCACerts();
-
 module.exports = function (request, options, onStart, onData, callback) {
     var req = {};
 

package/lib/requester/requester-pool.js

@@ -24,6 +24,7 @@ RequesterPool = function (options, callback) {
         cookieJar: _.get(options, 'requester.cookieJar'), // default set later in this constructor
         strictSSL: _.get(options, 'requester.strictSSL'),
         maxResponseSize: _.get(options, 'requester.maxResponseSize'),
+        protocolVersion: _.get(options, 'requester.protocolVersion'),
         // @todo drop support in v8
         useWhatWGUrlParser: _.get(options, 'requester.useWhatWGUrlParser', false),
         insecureHTTPParser: _.get(options, 'requester.insecureHTTPParser'),

package/lib/requester/requester.js

@@ -418,7 +418,7 @@ class Requester extends EventEmitter {
         // we can't trust the integrity of this request
         // bail out if request url is empty
         if (!(request && request.url && request.url.toString && request.url.toString())) {
-            return onEnd(new Error('runtime:extensions~request: request url is empty'));
+            return onEnd(new Error('runtime: request url is empty'));
         }
 
         cookieJar = self.options.cookieJar;
@@ -470,7 +470,8 @@ class Requester extends EventEmitter {
                 status: res && res.statusMessage,
                 header: responseHeaders,
                 stream: resBody,
-                responseTime: responseTime
+                responseTime: responseTime,
+                downloadedBytes: history.execution.data[0].response.downloadedBytes
             });
 
             onComplete(RESPONSE_END, response, history);

package/lib/runner/extensions/event.command.js

@@ -270,7 +270,7 @@ module.exports = {
             async.mapSeries(events, function (event, next) {
                 // In case the event has no script or execution was skipped
                 // in some previous script we bail out early
-                if (!event.script || shouldSkipExecution) {
+                if (shouldSkipExecution || !event.script || event.script.isEmpty()) {
                     return next(null, { event });
                 }
 
@@ -434,7 +434,10 @@ module.exports = {
                                     // instance once it is fully supported
                                     result && { cookies: result.cookies });
                             }).catch(function (err) {
-                                this.host.dispatch(EXECUTION_RESPONSE_EVENT_BASE + id, requestId, err);
+                                const error = serialisedError(err);
+
+                                delete error.stack; // remove stack to avoid leaking runtime internals
+                                this.host.dispatch(EXECUTION_RESPONSE_EVENT_BASE + id, requestId, error);
                             });
                         }.bind(this));
                     }.bind(this));
@@ -455,7 +458,11 @@ module.exports = {
                             // @todo: Expose this as a property in Collection SDK's Script
                             timeout: payload.scriptTimeout,
                             cursor: scriptCursor,
-                            context: _.pick(payload.context, SAFE_CONTEXT_VARIABLES),
+                            context: {
+                                ..._.pick(payload.context, SAFE_CONTEXT_VARIABLES),
+                                vaultSecrets: _.get(payload.context.vaultSecrets, '_.allowScriptAccess') ?
+                                    payload.context.vaultSecrets : undefined
+                            },
                             resolvedPackages: resolvedPackages,
 
                             // legacy options
@@ -522,6 +529,8 @@ module.exports = {
                             result && result.globals && (result.globals = new sdk.VariableScope(result.globals));
                             result && result.collectionVariables &&
                                 (result.collectionVariables = new sdk.VariableScope(result.collectionVariables));
+                            result && result.vaultSecrets &&
+                                (result.vaultSecrets = new sdk.VariableScope(result.vaultSecrets));
                             result && result.request && (result.request = new sdk.Request(result.request));
 
                             // @note Since postman-sandbox@3.5.2, response object is not included in the execution

package/lib/runner/extensions/http-request.command.js

@@ -112,7 +112,7 @@ module.exports = {
                     var requestId = uuid.v4(),
                         replayOptions;
 
-                    // eslint-disable-next-line max-len
+                    // eslint-disable-next-line @stylistic/js/max-len
                     requester.on(RESPONSE_START_EVENT_BASE + requestId, function (err, response, request, cookies, history) {
                         // we could have also added the response to the set of responses in the cloned item,
                         // but then, we would have to iterate over all of them, which seems unnecessary
@@ -152,7 +152,7 @@ module.exports = {
                     requester.on(RESPONSE_DATA_EVENT_BASE + requestId, function (data) {
                         self.triggers.responseData(context.coords, data);
                     });
-                    // eslint-disable-next-line max-len
+                    // eslint-disable-next-line @stylistic/js/max-len
                     xhr = requester.request(requestId, item.request, context.protocolProfileBehavior, function (err, res, req, cookies, history) {
                         err = err || null;
 

package/lib/runner/extensions/item.command.js

@@ -70,7 +70,8 @@ getResponseJSON = function (response) {
             type: 'Base64',
             data: response.stream.toString('base64')
         },
-        responseTime: response.responseTime
+        responseTime: response.responseTime,
+        downloadedBytes: response.downloadedBytes
     };
 };
 
@@ -137,6 +138,7 @@ module.exports = {
                 // create the context object for scripts to run
                 ctxTemplate = {
                     collectionVariables: collectionVariables,
+                    vaultSecrets: vaultSecrets,
                     _variables: _variables,
                     globals: globals,
                     environment: environment,
@@ -150,7 +152,7 @@ module.exports = {
                     item: item,
                     coords: coords,
                     context: ctxTemplate,
-                    trackContext: ['globals', 'environment', 'collectionVariables'],
+                    trackContext: ['globals', 'environment', 'collectionVariables', 'vaultSecrets'],
                     stopOnScriptError: stopOnError,
                     stopOnFailure: stopOnFailure
                 }).done(function (prereqExecutions, prereqExecutionError, shouldSkipExecution) {
@@ -188,7 +190,7 @@ module.exports = {
 
                     this.queue('request', {
                         item: item,
-                        vaultSecrets: vaultSecrets,
+                        vaultSecrets: ctxTemplate.vaultSecrets,
                         globals: ctxTemplate.globals,
                         environment: ctxTemplate.environment,
                         collectionVariables: ctxTemplate.collectionVariables,
@@ -232,7 +234,7 @@ module.exports = {
                             item: item,
                             coords: coords,
                             context: ctxTemplate,
-                            trackContext: ['tests', 'globals', 'environment', 'collectionVariables'],
+                            trackContext: ['tests', 'globals', 'environment', 'collectionVariables', 'vaultSecrets'],
                             stopOnScriptError: stopOnError,
                             abortOnFailure: abortOnFailure,
                             stopOnFailure: stopOnFailure

package/lib/runner/index.js

@@ -101,7 +101,7 @@ _.assign(Runner.prototype, {
 
             // Bail out only if: abortOnError is set and the returned entrypoint is invalid
             if (options.abortOnError && !entrypoint) {
-                // eslint-disable-next-line max-len
+                // eslint-disable-next-line @stylistic/js/max-len
                 return callback(new Error(`Unable to find a folder or request: ${_.get(options, 'entrypoint.execute')}`));
             }
 

package/lib/runner/run.js

@@ -208,7 +208,7 @@ Run.commands = _.transform({
     // extract the prototype from the command interface
     if (_.has(extension, 'prototype')) {
         _.forOwn(extension.prototype, function (value, prop) {
-            if (Object.hasOwnProperty.call(Run.prototype, prop)) {
+            if (Object.hasOwn(Run.prototype, prop)) {
                 throw new Error('run: duplicate command prototype extension ' + prop);
             }
             Run.prototype[prop] = value;
@@ -226,7 +226,7 @@ Run.commands = _.transform({
     if (_.has(extension, 'process')) {
         _.forOwn(extension.process, function (command, name) {
             if (!_.isFunction(command)) { return; }
-            if (Object.hasOwnProperty.call(all, name)) {
+            if (Object.hasOwn(all, name)) {
                 throw new Error('run: duplicate command processor ' + name);
             }
             // finally add the command function to the accumulator

package/lib/runner/util.js

@@ -119,14 +119,14 @@ module.exports = {
 
         // update or add values from src
         for (prop in src) {
-            if (Object.hasOwnProperty.call(src, prop)) {
+            if (Object.hasOwn(src, prop)) {
                 dest[prop] = src[prop];
             }
         }
 
         // remove values that no longer exist
         for (prop in dest) {
-            if (Object.hasOwnProperty.call(dest, prop) && !Object.hasOwnProperty.call(src, prop)) {
+            if (Object.hasOwn(dest, prop) && !Object.hasOwn(src, prop)) {
                 delete dest[prop];
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postman-runtime",
-  "version": "7.40.0-beta.1",
+  "version": "7.41.0",
   "description": "Underlying library of executing Postman Collections",
   "author": "Postman Inc.",
   "license": "Apache-2.0",
@@ -44,19 +44,19 @@
   "dependencies": {
     "@postman/tough-cookie": "4.1.3-postman.1",
     "async": "3.2.5",
-    "aws4": "1.12.0",
+    "aws4": "1.13.0",
     "handlebars": "4.7.8",
     "httpntlm": "1.8.13",
-    "jose": "4.14.4",
+    "jose": "5.6.3",
     "js-sha512": "0.9.0",
     "lodash": "4.17.21",
     "mime-types": "2.1.35",
     "node-forge": "1.3.1",
     "node-oauth1": "1.3.0",
     "performance-now": "2.1.0",
-    "postman-collection": "4.4.0",
-    "postman-request": "2.88.1-postman.33",
-    "postman-sandbox": "5.0.0-beta.1",
+    "postman-collection": "4.5.0",
+    "postman-request": "2.88.1-postman.37",
+    "postman-sandbox": "5.1.1",
     "postman-url-encoder": "3.0.5",
     "serialised-error": "1.1.3",
     "strip-json-comments": "3.1.1",
@@ -64,41 +64,43 @@
   },
   "devDependencies": {
     "@postman/shipit": "^0.4.0",
-    "ajv": "^8.12.0",
+    "@stylistic/eslint-plugin-js": "^1.8.0",
+    "ajv": "^8.17.1",
     "browserify": "^17.0.0",
     "chai": "^4.3.10",
     "chalk": "^4.1.2",
     "dependency-check": "^4.1.0",
-    "editorconfig": "^1.0.2",
-    "eslint": "^7.32.0",
-    "eslint-plugin-jsdoc": "^36.1.1",
+    "editorconfig": "^2.0.0",
+    "eslint": "^8.57.0",
+    "eslint-plugin-jsdoc": "^47.0.2",
     "eslint-plugin-lodash": "^7.4.0",
-    "eslint-plugin-mocha": "^10.4.1",
+    "eslint-plugin-mocha": "^10.5.0",
+    "eslint-plugin-n": "^16.6.2",
     "eslint-plugin-security": "^2.1.1",
     "express": "^4.17.2",
     "graphql": "^15.7.2",
     "js-yaml": "^4.1.0",
-    "karma": "^6.4.3",
+    "karma": "^6.4.4",
     "karma-browserify": "^8.1.0",
     "karma-chrome-launcher": "^3.2.0",
     "karma-mocha": "^2.0.1",
     "karma-mocha-reporter": "^2.2.5",
     "mocha": "^9.1.3",
     "nyc": "^15.1.0",
-    "parse-gitignore": "^1.0.1",
+    "parse-gitignore": "^2.0.0",
     "passport": "^0.7.0",
     "passport-http": "^0.3.0",
     "recursive-readdir": "^2.2.3",
     "server-destroy": "^1.0.1",
     "shelljs": "^0.8.5",
-    "sinon": "^12.0.1",
+    "sinon": "^18.0.0",
     "teleport-javascript": "^1.0.0",
-    "terser": "^5.30.2",
+    "terser": "^5.31.3",
     "tmp": "^0.2.3",
-    "webpack": "^5.91.0",
+    "webpack": "^5.93.0",
     "yankee": "^1.0.8"
   },
   "engines": {
-    "node": ">=12"
+    "node": ">=16"
   }
 }