MLE-31583 Node Client 4.2.0 Release - #1120
Merged
Merged
Conversation
MLE-26608 - merge release changes into develop
This reverts commit 5518e9c.
This reverts commit 23d8bbd.
This reverts commit 70f361b.
Bumped minimatch, and added a force on serialize-javascript (used by mocha) and underscore (used by jsdoc).
Adds explicit top-level permissions: contents: read to limit the default GITHUB_TOKEN scope for all jobs. Individual jobs that need write access (copyright-validation) already declare their own permissions block which overrides the default. This follows the principle of least privilege recommended in GitHub's PwnRequest security guidance.
…sions PDP-1182 SECCMP-1797: Add top-level permissions to restrict default token
…rom-develop PDP-1182: Remove per-repo pr-workflow.yaml
* MLE-28498 Permission fixes This contains permission fixes for testing as a result of the 11.3.5 changes. * MLE-28498 transform test fixes Updated transforms tests to expect rest-transform-user as a result of 11.3.5 changes from ML-28684. * MLE-28498 dmsdk fixes Copilot fix for flakey dmsdk tests * MLE-28498 Skip optic-fromDocs tests for < 12.1 After confirming with the MarkLogic Server team, op:from-docs is only supported in MLS 12.1 since it is a new feature. I have added a skip for anything lower than MLS 12.1
* MLE-27883 adapt cts.param in the Optic API for MLS 12.1 * MLE-27883 update Copyright * MLE-27883 fix to traverse the exported plan to verify the cts namespace
* MLE-28335 added fragment option in fromSearch - Add 'fragment' option support to fromSearch() for MLS 12.1+ - Valid values: 'document' (default), 'properties', 'locks', 'any' - Client-side validation in PlanSearchOption (plan-builder-base.js) - Updated JSDoc for fromSearch() in plan-builder-generated.js - Added xdmp-lock-acquire/release privileges to rest-evaluator role in both test-setup-users.js and rest-evaluator.json (Gradle config) - Added fragment option integration tests to test-basic/plan-search.js (TC0-TC5, gated on serverVersion >= 12.1) * MLE-28336 updated Copyright * MLE-28335 update fromSearchDocs with fragment option * MLE-28335 resolve npm audit vulnerabilities (0 remaining) Security fixes: - sanitize-html: 2.17.0 → ^2.17.4 (critical XSS via xmp passthrough, GHSA-rpr9-rxv7-x643) - brace-expansion override: 2.0.2 → 5.0.6 (DoS via zero-step sequence, GHSA-f886-m6hf-6m8v) - serialize-javascript override: 7.0.4 → 7.0.5 (CPU exhaustion DoS, GHSA-qj8w-gfj5-8c6v) - diff override: added 9.0.0 (DoS in parsePatch/applyPatch for mocha 11.4+, GHSA-73rr-hh4g-fpgx) - fast-uri, flatted, lodash, picomatch, postcss updated via npm audit fix * MLE-28335 update scheduled trigger for regressions * MLE-28335 skip cts.param integration tests for server < 12.1 * MLE-28335 fix to use the correct optic test database testconfig.restWriterConnection
* MLE-28583 xdmp.uriContentType and xdmp.uriFormat test fix xdmp.uriContentType and xdmp.uriFormat are no longer callable and these tests should only run on ML11 or lower * MLE-28583 transform user test fix The previous change was a regression fixed by the ML server team and the test has been updated to reflect the correct behavior
* MLE-29694 update qs to 6.15.2 * MLE-29694 fixed flaky fragment option tests for fromSearch * MLE-29694 fixed flaky fragment option tests * MLE-29694 fixed typo in comment
* MLE-30684 Switch to Harness Artifact Registry * MLE-30684 npm audit non blocking in Jenkins
* MLE-30686 Bump form-data Bump form-data from version 4.0.4 -> 4.0.6 to fix vulnerability * MLE-30964 Bump markdown-it override Bump markdown-it override from 14.1.1 -> 14.2.0
…t-cts-query MLE-29889 param binding accept cts query
MLE-31764: [HIGH] BDSA-2026-24772 in nanoid v3.3.12 (MarkLogic-DevExp-nodeapi)
Renamed sbom file to be more consistent across repositories Updated sbom for 4.2 release
MLE-32051 Fix multipart body termination for Node.js v26 compatibility
MLE-32228 Ship SBOM in NPM package
MLE-31580 Update NOTICE for 4.2.0
MLE-31994 Update version to 4.2.0
rjdew-progress
requested review from
BillFarber,
anu3990,
rjrudin and
stevebio
as code owners
September 3, 2026 15:46
rjdew-progress
requested review from
RitaChen609 and
ngodugu-marklogic
and removed request for
BillFarber,
anu3990,
rjrudin and
stevebio
September 3, 2026 15:47
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
A newly modified vector test is flaky due to parallel async work with a single done() callback, and there are additional release-impacting behavior changes (e.g., token duration validation/logging) that should be adjusted before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR prepares the MarkLogic Node Client API 4.2.0 release by bumping the package version, updating documentation, and landing a set of functional/security enhancements across the client runtime, Optic plan builder, and test infrastructure.
Changes:
- Added/extended Optic plan-builder capabilities (e.g.,
op.cts.param(),fromDocs, fragment option validation) and strengthened runtime plan/binding handling. - Security and reliability hardening (session ID generation via
crypto.randomBytes, extlibs path encoding/traversal prevention, TLS config/cert handling, cloud token request safety). - Release/package housekeeping (version bump, dependency updates, SBOM publishing support, docs, CI tweaks, and expanded automated tests).
File summaries
| File | Description |
|---|---|
| test-typescript/telemetry-header-runtime.test.ts | Runtime smoke test for telemetry header default/opt-out behavior. |
| test-typescript/optic-cts-param-runtime.test.ts | Runtime smoke tests for op.cts.param() plan construction/serialization. |
| test-typescript/optic-bindparam-ctsquery-runtime.test.ts | Runtime smoke tests for binding CTS queries via bindParam/search/where. |
| test-typescript/basic-types.test.ts | Type-check coverage for disableTelemetryHeader option. |
| test-complete/nodejs-transform-javascript.js | Fix promise error handling style (catch(done)). |
| test-complete/nodejs-dmsdk-readall-1.js | Correct callback flow (avoid done() after done(err)). |
| test-basic/transitive-closure.js | New integration tests for transitiveClosure (MLS 12+). |
| test-basic/telemetry-header-test.js | New integration tests for ML-Agent-ID telemetry header toggle. |
| test-basic/ssl-min-allow-tls-test.js | Increased timeout for TLS test reliability. |
| test-basic/ssl-config-security-test.js | New guard tests against rejectUnauthorized:false and CA handling. |
| test-basic/session-state-test.js | New tests asserting session ID format/stability. |
| test-basic/service-caller.js | Skips a flaky endpoint test (currently without actionable tracking). |
| test-basic/plan-search.js | Adds fragment option integration tests for fromSearch (MLS 12.1+). |
| test-basic/plan-builder-generated.js | Updates/guards tests for server-version-dependent behavior; vector base64 decode assertion fix. |
| test-basic/optic-vector.js | Refactors vector tests to assert concrete expected values. |
| test-basic/optic-fromDocs.js | New integration tests for op.fromDocs() and column builder usage (MLS 12.1+). |
| test-basic/optic-cts-param-test.js | New integration tests for cts.param parameter binding scenarios. |
| test-basic/extlibs.js | Adds negative/security tests for extlibs path validation & encoding. |
| test-basic/cloud_authentication-test.js | Adds tests for token duration encoding, validation, and error routing. |
| test-app/src/main/ml-data/optic/transitive-closure/transClosureTripleSet.xml | New test data for transitive-closure tests. |
| test-app/src/main/ml-data/optic/transitive-closure/permissions.properties | Permissions for new transitive-closure test data. |
| test-app/src/main/ml-data/optic/transitive-closure/collections.properties | Collections/graph metadata for transitive-closure test data. |
| test-app/src/main/ml-config/security/users/rest-writer.json | Adds role(s) needed for new tests/extensions. |
| test-app/src/main/ml-config/security/users/rest-temporal-writer.json | Adds role(s) needed for new tests/extensions. |
| test-app/src/main/ml-config/security/users/rest-reader.json | Adds role(s) needed for new tests/extensions. |
| test-app/src/main/ml-config/security/users/rest-admin.json | Adds roles/privileges needed for new test behaviors (SPARQL, extensions, eval). |
| test-app/src/main/ml-config/security/roles/rest-evaluator.json | Adds inherited role + execute privileges (locks, XSLT, etc.) for new tests. |
| test-app/build.gradle | Replaces temp-cert command with an openssl-based CA/server cert pipeline; parameterizes host in curl tasks. |
| README.md | Updates release version, documents disableTelemetryHeader, and clarifies options text. |
| package.json | Version bump to 4.2.0, dependency updates, SBOM publish step, and packaging tweaks. |
| marklogic.d.ts | Adds disableTelemetryHeader?: boolean to DatabaseClientConfig. |
| LICENSE.txt | Updates header/formatting while retaining Apache 2.0 text. |
| lib/www-authenticate-patched/www-authenticate.js | Replaces deprecated crypto.pseudoRandomBytes with crypto.randomBytes. |
| lib/session-state.js | Switches session ID generation to cryptographic randomness; updates doc return type. |
| lib/server-types-generated.js | Adds a CtsParam server type for plan serialization/typing. |
| lib/rows.js | Adds plan-parameter substitution for plan-builder nodes in bindings/bindingArg; safer parsing for string bindings. |
| lib/requester.js | Encodes cloud token duration, improves token error handling, adds telemetry header opt-out, and rewrites multipart logic for Node v26+ behavior. |
| lib/plan-builder.js | Adds planBuilder.cts.param() API surface. |
| lib/plan-builder-generated.js | Broad generated API updates (CTS param acceptance, fragment option validation, vec/node typing, fromDocs/columnBuilder plumbing, transitiveClosure, context/xpath changes). |
| lib/plan-builder-base.js | Adjusts argument casting for vec/cts.param cases; validates new plan option keys (fragment/transitiveClosure). |
| lib/marklogic.js | Adds disableTelemetryHeader support and cloud accessTokenDuration validation; warns on BASIC without SSL. |
| lib/extlibs.js | Adds safe extlibs path encoding with traversal prevention; encodes permissions query params. |
| Jenkinsfile | Makes npm audit non-blocking and adjusts scheduled trigger time. |
| etc/test-setup-users.js | Adds execute privileges required by new lock-related tests. |
| etc/test-config.js | Loads CA from generated PEM and removes rejectUnauthorized:false usage. |
| etc/test-config-qa.js | Loads CA from generated PEM and removes rejectUnauthorized:false usage. |
| etc/test-config-qa-ssl.js | Loads CA from generated PEM and removes rejectUnauthorized:false usage. |
| CODEOWNERS | Updates default code owners list. |
| CHANGELOG.md | Adds 4.2.0 entry documenting session ID security change. |
| .npmrc | Updates registry settings and adds install hardening knobs. |
| .gitignore | Ignores generated SBOM artifacts, generated proxy outputs, and generated SSL cert/key material. |
| .github/workflows/pr-workflow.yaml | Removes the PR workflow that validated JIRA/copyright. |
| .copyrightconfig | Expands excluded file patterns (e.g., CODEOWNERS, *.txt). |
Review details
- Files reviewed: 51/57 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+744
to
+746
| if (authType === 'BASIC' && !isSSL) { | ||
| console.warn('Authentication type is BASIC and SSL is not enabled. This may expose credentials.'); | ||
| } |
Comment on lines
+770
to
+773
| if (connectionParams.accessTokenDuration !== undefined && | ||
| (!Number.isInteger(connectionParams.accessTokenDuration) || connectionParams.accessTokenDuration <= 0)) { | ||
| throw new Error('accessTokenDuration must be a positive integer.'); | ||
| } |
| "scripts": { | ||
| "doc": "jsdoc -c jsdoc.json lib/*.js README.md", | ||
| "lint": "gulp lint", | ||
| "prepublishOnly": "cp sbom.spdx.json \"marklogic-${npm_package_version}.spdx.json\"", |
Comment on lines
+63
to
+72
| "ajv": "^8.18.0", | ||
| "ast-types": "0.14.2", | ||
| "astring": "1.9.0", | ||
| "bunyan": "1.8.15", | ||
| "chai": "6.2.0", | ||
| "core-util-is": "1.0.3", | ||
| "eslint": "9.38.0", | ||
| "gulp": "5.0.1", | ||
| "gulp-eslint-new": "2.5.0", | ||
| "gulp-mocha": "10.0.1", | ||
| "gulp-eslint-new": "^2.6.0", | ||
| "gulp-mocha": "^10.0.1", |
Comment on lines
+82
to
+86
| testPlan([""],op.math.floor(op.vec.cosine(vec1, vec2))) | ||
| .then(function(response) { | ||
| assert(response.rows[0].t.value != null); | ||
| assert(response.rows[0].t.value == 0, 'Cosine similarity between orthogonal vectors should be 0'); | ||
| }).catch(error => done(error)); | ||
|
|
RitaChen609
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.