fix: address dependency vulnerabilities and report privacy

.github/workflows/node.js.yml

@@ -117,15 +117,7 @@ jobs:
         working-directory: examples/${{ matrix.example }}
       - run: npm audit signatures
         working-directory: examples/${{ matrix.example }}
-      - name: Smoke test Express example
-        if: matrix.example == 'express-sample'
-        working-directory: examples/express-sample
+      - name: Test example error reporting against a local endpoint
         env:
-          NODE_ENV: production
-        run: node -e "require('./app')"
-      - name: Smoke test domains example
-        if: matrix.example == 'using-domains'
-        working-directory: examples/using-domains
-        run: |
-          node --check app.js
-          node -e "require('config'); require('raygun')"
+          RAYGUN_TEST_EXAMPLE: ${{ matrix.example }}
+        run: npm run test:examples

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+- Updated vulnerable transitive development dependencies and the Express example's Morgan and proxy-addr dependencies.
+- Removed report payloads and transport error text from transport diagnostics while preserving errors returned to callers.
+- Documented request-filter boundaries and redaction with `onBeforeSend`.
+
 ## 2.2.9
 
 - Maintenance-only release; no public API or runtime behavior changes.

CONTRIBUTING.md

@@ -17,6 +17,20 @@ The recommended IDE for working on this project is Visual Studio Code.
 
 To run tests, run `npm run test` or run all tests from VSCode.
 
+To test the actual examples against a local mock Raygun endpoint, run these
+commands from the repository root (Node.js 20 or later):
+
+```sh
+npm run prepare
+npm --prefix examples/express-sample ci --ignore-scripts
+npm --prefix examples/using-domains ci --ignore-scripts
+npm run test:examples
+```
+
+These tests use a test API key and do not contact Raygun. Set
+`RAYGUN_TEST_EXAMPLE=express-sample` or `RAYGUN_TEST_EXAMPLE=using-domains` to run
+only one example.
+
 ### Code analysis
 
 To check the code, run `npm run eslint` and `npm run tseslint`.
@@ -63,4 +77,3 @@ Wait for a review by the Raygun team.
 The team will leave you feedback and might ask you to do changes in your code.
 
 Once the PR is approved, the team will merge it.
-

README.md

@@ -183,6 +183,35 @@ const raygun = require('raygun');
 const raygunClient = new raygun.Client().init({ apiKey: 'YOUR_API_KEY', filters: ['password', 'creditcard'] });
 ```
 
+### Protecting sensitive data
+
+No request keys are filtered by default. `filters` removes exact, case-sensitive keys
+recursively from request headers, query parameters, and parsed request bodies.
+For Node.js request headers, use lowercase keys such as `authorization` and `cookie`.
+Filters do not sanitize raw strings, error messages, user information, custom data,
+or breadcrumbs. Avoid collecting credentials and personal data in these fields.
+
+Use `onBeforeSend` to review the complete report before transport. For example,
+remove custom data and breadcrumbs if your application does not need them:
+
+```javascript
+const raygunClient = new raygun.Client().init({
+  apiKey: 'YOUR_API_KEY',
+  filters: ['authorization', 'cookie', 'password', 'creditcard'],
+  onBeforeSend: function (payload) {
+    delete payload.details.userCustomData;
+    delete payload.details.breadcrumbs;
+    return payload;
+  }
+});
+```
+
+If you retain these sections, allowlist the fields your application needs and redact
+their values before sending. Review error messages and user information separately.
+Transport diagnostics do not log report payloads or transport error text, but other
+SDK debug messages can contain application-provided text. Keep `DEBUG=raygun`
+disabled in production unless you have reviewed the data and log access controls.
+
 ### Tags
 
 You can add tags to your error in the Send() function, as the `tags` parameter. For example:

examples/express-sample/package.json

@@ -12,7 +12,7 @@
     "debug": "^4.3.4",
     "ejs": "~6.0.1",
     "express": "^4.22.2",
-    "morgan": "^1.12.0",
+    "morgan": "^1.12.1",
     "raygun": "file:../..",
     "serve-favicon": "^2.5.1"
   },

lib/raygun.batch.ts

@@ -82,9 +82,8 @@ export class RaygunBatchTransport {
 
     if (messageLength >= MAX_BATCH_INNER_SIZE_BYTES) {
       const messageSize = Math.ceil(messageLength / 1024);
-      const startOfMessage = serializedMessage.slice(0, 1000);
 
-      const errorMessage = `Error is too large to send to Raygun (${messageSize}kb)\nStart of error: ${startOfMessage}`;
+      const errorMessage = `Error is too large to send to Raygun (${messageSize}kb)`;
       console.error(`[Raygun4Node] ${errorMessage}`);
       throw Error(errorMessage);
     }
@@ -153,7 +152,7 @@ export class RaygunBatchTransport {
       const durationInMs = stopTimer();
       if (err) {
         debug(
-          `[raygun.batch.ts] Batch transport - error sending batch (id=${batchId}, duration=${durationInMs}ms): ${err}`,
+          `[raygun.batch.ts] Batch transport - error sending batch (id=${batchId}, duration=${durationInMs}ms)`,
         );
         for (const promise of promises) {
           promise.reject(err);

lib/raygun.transport.ts

@@ -61,26 +61,20 @@ export function send(
           resolve(response);
           // destroy the request after successful completion
           request.destroy();
-          debug(
-            `[raygun.transport.ts] Request destroyed for message: ${options.message}`,
-          );
+          debug("[raygun.transport.ts] Request destroyed after sending report");
         },
       );
 
       if (options.http?.timeout) {
         debug(`[raygun.transport.ts] Timeout set: ${options.http.timeout}ms`);
         request.setTimeout(options.http.timeout, () => {
-          console.error(
-            `[Raygun4Node] request timed out while attempting to send error with message: ${options.message}`,
-          );
+          console.error("[Raygun4Node] Request timed out while sending report");
           request.destroy(new Error("Request timed out"));
         });
       }
 
       request.on("error", function (e) {
-        console.error(
-          `[Raygun4Node] Error with details "${e.message}" occurred while attempting to send error with message: ${options.message}`,
-        );
+        console.error("[Raygun4Node] Transport error while sending report");
 
         // request failed
         reject(e);
@@ -90,9 +84,7 @@ export function send(
       request.end();
     });
   } catch (e) {
-    console.error(
-      `[Raygun4Node] Error "${e}" occurred while attempting to send error with message: ${options.message}`,
-    );
+    console.error("[Raygun4Node] Failed to prepare report for transport");
     return Promise.reject(e);
   }
 }

lib/raygun.ts

@@ -312,9 +312,7 @@ class Raygun {
     }
 
     if (sendOptionsResult.skip) {
-      console.log(
-        `[Raygun4Node] Skip sending message: ${sendOptionsResult.message.details.error}.`,
-      );
+      console.log("[Raygun4Node] Skipped sending report");
       return Promise.resolve(null);
     }
 
@@ -353,7 +351,7 @@ class Raygun {
         .catch((error) => {
           const durationInMs = stopTimer();
           debug(
-            `[raygun.ts] Error sending message (duration=${durationInMs}ms): ${error}`,
+            `[raygun.ts] Error sending message (duration=${durationInMs}ms)`,
           );
           return error;
         });
@@ -405,9 +403,7 @@ class Raygun {
 
     if (result.valid) {
       if (result.skip) {
-        console.log(
-          `[Raygun4Node] Skip sending message: ${result.message.details.error}.`,
-        );
+        console.log("[Raygun4Node] Skipped sending report");
         return;
       }
       raygunSyncTransport.send(result.options);

package.json

@@ -43,6 +43,7 @@
     "prepare": "tsc",
     "//test": "runs tests on main project",
     "test": "tap --node-arg=-r --node-arg=ts-node/register --disable-coverage test/*_test.js",
+    "test:examples": "tap --node-arg=-r --node-arg=ts-node/register --disable-coverage test/examples_integration.js",
     "//test:cjs": "tests CommonJS compatibility (catches ESM-only deps)",
     "test:cjs": "node --no-experimental-require-module scripts/test-cjs-compat.js"
   },