MLE-31583 Node Client 4.2.0 Release

.copyrightconfig

@@ -11,4 +11,4 @@ startyear: 2015
 #   - Dotfiles already skipped automatically
 # Enable by removing the leading '# ' from the next line and editing values.
 # filesexcluded: third_party/*, docs/generated/*.md, assets/*.png, scripts/temp_*.py, vendor/lib.js
-filesexcluded: .github/*, README.md, Jenkinsfile, test-app/*, *.md, docker-compose.yaml, test-complete-app-mlDeploy/*, *.json, *.sh
+filesexcluded: .github/*, README.md, Jenkinsfile, test-app/*, *.md, docker-compose.yaml, test-complete-app-mlDeploy/*, *.json, *.sh, CODEOWNERS, *.txt

.gitignore

@@ -20,5 +20,30 @@ test-complete-app/.gradle
 test-complete-app-mlDeploy/build
 test-complete-app-mlDeploy/.gradle
 
+# Generated files for publishing to npm
+marklogic-*.spdx.json
+
 # Compiled TypeScript test files
 test-typescript/*.js
+
+# AI generated documents
+documents
+
+# Generated proxy stubs (created by gulp setupProxyTests / generateProxyTests)
+# Files in the generated directory are fully generated
+test-basic-proxy/lib/generated/
+# the proxy stubs (non-Test.js) are generated; the *Test.js files are hand-written and must be kept
+test-basic-proxy/lib/positive/*.js
+!test-basic-proxy/lib/positive/*Test.js
+test-basic-proxy/lib/negative/*.js
+!test-basic-proxy/lib/negative/*Test.js
+
+# SSL certificates generated at deploy time by mlDeploy/generateAndInstallSslCertificate.
+# Never commit private keys or regenerated certs — they change on every deployment.
+test-app/src/main/ml-config/self-signed-ca.pem
+test-app/src/main/ml-config/self-signed-ca.key
+test-app/src/main/ml-config/ssl-server.pem
+test-app/src/main/ml-config/ssl-server.key
+test-app/src/main/ml-config/ssl-server.csr
+test-app/src/main/ml-config/ssl-server-ext.cnf
+test-app/src/main/ml-config/*.srl

.npmrc

@@ -1 +1,6 @@
 engine-strict=true
+registry=https://pkg.harness.io/pkg/ct8onj8YTdaXtKaFsYCRLg/org-marklogic-npm/npm/
+@jsr:registry=https://pkg.harness.io/pkg/ct8onj8YTdaXtKaFsYCRLg/org-marklogic-npm/npm/
+ignore-scripts=true
+# cooldown in days (14 days)
+min-release-age=14

CHANGELOG.md

@@ -1,5 +1,15 @@
 # CHANGELOG
 
+## 4.2.0
+
+#### Security Fix
+
+- Session IDs generated by `SessionState` now use `crypto.randomBytes()` instead of `Math.random()`, replacing a
+  non-cryptographic PRNG (xorshift128+) with a cryptographically secure source of randomness (CWE-338).
+  The session ID is now a 16-character hex string (8 random bytes), matching the format MarkLogic uses for its own
+  server-generated session IDs. The return type of `SessionState.sessionId()` changes from `number` to `string`.
+  Callers that only use the session ID for logging or cookie headers are unaffected.
+
 ## 4.1.0
 
 - Added TypeScript typings for core client/document/connection APIs, with better autocomplete and compile-time checks to catch mistakes earlier.

CODEOWNERS

@@ -2,5 +2,4 @@
 # Each line is a file pattern followed by one or more owners.
 
 # These owners will be the default owners for everything in the repo.
-* @anu3990 @billfarber @rjrudin @stevebio
-
+* @rjrudin @jonmille @ngodugu-marklogic @RitaChen609 @rjdew-progress

Jenkinsfile

@@ -55,7 +55,7 @@ def runAuditReport() {
 		cd node-client-api
 		npm ci
 		rm -rf $WORKSPACE/npm-audit-report.json || true
-		npm audit --audit-level=moderate --json > $WORKSPACE/npm-audit-report.json
+		npm audit --audit-level=moderate --json > $WORKSPACE/npm-audit-report.json || true
 	'''
 }
 
@@ -125,7 +125,7 @@ pipeline {
   agent none
 
   triggers {
-    parameterizedCron(env.BRANCH_NAME == "develop" ? "00 02 * * * % regressions=true" : "")
+    parameterizedCron(env.BRANCH_NAME == "develop" ? "00 05 * * * % regressions=true" : "")
   }
 
   parameters {
@@ -151,6 +151,7 @@ pipeline {
     stage('pull-request-tests') {
       agent { label 'nodeclientpool' }
       steps {
+        // npm audit is non-blocking; Harness Artifact Repository does not currently support it so failures are ignored.
         runAuditReport()
         runLint()
         runTypeCheck()

LICENSE.txt

@@ -1,5 +1,21 @@
-Apache License 
-Version 2.0, January 2004 
+Copyright © 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+
+Apache License
+Version 2.0, January 2004
 http://www.apache.org/licenses/
 TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -59,14 +75,14 @@ To apply the Apache License to your work, attach the following boilerplate notic
 
 Copyright [yyyy] [name of copyright owner]
 
-Licensed under the Apache License, Version 2.0 (the "License"); 
-you may not use this file except in compliance with the License. 
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
 http://www.apache.org/licenses/LICENSE-2.0
 
-Unless required by applicable law or agreed to in writing, software 
-distributed under the License is distributed on an "AS IS" BASIS, 
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
-See the License for the specific language governing permissions and 
-limitations under the License.
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.