Release 5.2.0 - #370
Merged
Merged
Conversation
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.19 to 8.5.26. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.19...8.5.26) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
The masking engine has returned any Error untouched since 4.4.0, when the walk stopped writing the placeholder into the caller's objects (#180) by skipping errors altogether. That left the gap reported in #361 and earlier in #214: a secret in `error.message`, in an own property assigned to the error, or down the `cause` chain reached the JSON line, the pretty error block and every transport's `nativeError` in plaintext, while the same secret in a string argument was redacted. Errors are now replaced by a masked clone, like every other argument. The clone is a genuine Error re-pointed at the source's prototype, so `instanceof`, the `[object Error]` tag and the JSON renderer's IErrorObject detection keep working, and no subclass constructor runs (#227). A cross-realm error (node:vm, an iframe) counts as a real Error by its tag. Every own property is defined fresh on the clone from a guarded read, so read-only and getter-only properties cannot throw (#217, #234) and the caller's instance is never written to. Inside an error, `name`, `message` and `stack` are exempt from `mask.keys`, because `keys: ["name"]` is ordinary PII configuration and must not blank every error. `mask.regex` still applies to their text and `mask.paths` can censor them explicitly. The stack is not regex-masked as a whole, since a token or digit pattern would corrupt frame positions. Only the `<name>: <message>` header of a V8-style stack is masked, with the same regexes as the message, so a header that was formatted before the message changed cannot keep the secret either. Firefox and Safari stacks have no header and stay untouched. Every other own property, `cause` included, is masked exactly like a plain object's. The full browser bundle grows by about 0.3KB gzip for the new branch, so its budget moves from 21.8KB to 22.2KB.
The README's masking section described masking as leak-proof without saying that errors were skipped, and the Sentry recipe promised the caller's native Error instance under `nativeError`. Both now describe the masked clone: what `regex`, `keys` and `paths` reach inside an error, why `keys` skips `name`, `message` and `stack`, and that stack frames are never regex-masked. llms.txt gets the same clause in its `mask` bullet, and the CHANGELOG its 5.2.0 entries.
Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.7 to 7.3.2. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.3 to 0.35.4. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) from 2.10.43 to 2.11.21. - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.43...v2.11.21) --- updated-dependencies: - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…docs/sharp-0.35.4 Bump sharp from 0.35.3 to 0.35.4 in /docs
…docs/smol-toml-1.8.0 Bump smol-toml from 1.7.0 to 1.8.0 in /docs
…docs/js-yaml-4.3.2 Bump js-yaml from 4.3.0 to 4.3.2 in /docs
…docs/astro-7.3.2 Bump astro from 7.0.7 to 7.3.2 in /docs
…docs/svgo-4.1.0 Bump svgo from 4.0.1 to 4.1.0 in /docs
…docs/nanoid-3.3.18 Bump nanoid from 3.3.15 to 3.3.18 in /docs
…baseline-browser-mapping-2.11.21 Bump baseline-browser-mapping from 2.10.43 to 2.11.21
…fast-uri-3.1.7 Bump fast-uri from 3.1.3 to 3.1.7
…postcss-8.5.26 Bump postcss from 8.5.19 to 8.5.26
…js-yaml-4.3.1 Bump js-yaml from 4.3.0 to 4.3.1
Mask inside logged errors instead of passing them through
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #370 +/- ##
===========================================
Coverage 100.00% 100.00%
===========================================
Files 54 53 -1
Lines 7256 4642 -2614
Branches 2228 1370 -858
===========================================
- Hits 7256 4642 -2614 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Masking now reaches inside logged errors. Minor bump because transports see a behavior change when
maskis configured.Changed
maskconfigured, a loggedErroris replaced by a masked clone, and that clone is what transports receive asnativeError. It is a realErrorwith the source's prototype, soinstanceof, JSON error detection and Sentry-style transports keep working; the caller's instance is never modified. Withoutmask, nothing changes.Fixed
causechain no longer reach the JSON line, the pretty error block ornativeErrorin plaintext (Bug: masking does not apply inside an error #361, Bug: Values in errors are no longer masked #214). Thanks @nkuba for Mask inside logged errors instead of passing them through #362.<name>: <message>stack header is masked for multi-line messages; stack frames are left alone.DOMExceptionkeeps its name and message when masked, including on Node 20.Maintenance
README, RECIPES.md and llms.txt document error masking and the
nativeErrorclone.