chore(deps): bump @hackylabs/deep-redact from 3.0.5 to 4.0.2 in /shade-agent-js

[dependabot]

Bumps @hackylabs/deep-redact from 3.0.5 to 4.0.2.

Release notes

Sourced from @​hackylabs/deep-redact's releases.

v4.0.2

Full Changelog: hackylabs/deep-redact@v4.0.1...v4.0.2

v4.0.1

A patch release that fixes a serialised-output bug and removes a performance cliff. It contains one technically breaking output change, included solely to correct buggy output.

⚠️ Breaking output change (bug fix)

Under serialise: true, a cycle through a Map or Set previously leaked the transformer's synthetic value wrapper into the circular-marker path. The path is now logical and consistent with object/array cycle paths and with the marker's own value field:

Shape	Before (4.0.0)	After (4.0.1)
root Set self-cycle	value.0	0
root Map self-cycle	value.me	me
nested Set self-cycle	roles.value.0	roles.0
nested Map self-cycle	meta.value.me	meta.me

If you parse circular markers inside Map/Set payloads, update accordingly. Unchanged: the deepRedact/createRedactor API and all options, exported types, the runtime input contract, all object-mode (serialise: false) output, every non-Map/Set marker, and the marker value field.

🚀 Performance

serialise: true no longer degrades non-linearly with payload depth. Path tracking is now lazy — materialised only when a circular marker is actually emitted — so deep payloads no longer pay a per-node descent cost. Measured ~4–5% faster than 4.0.0 on the deep serialised benchmark, with no object-mode regression. Output is byte-identical to the corrected contract above.

Compatibility

Drop-in for 4.0.0 unless you parse Map/Set circular-marker paths. Same Node support, same public API.

v4.0.0

What's new in v4.0.0

This is a complete rewrite with a new composable, function-first API and rule-driven traversal engine.

New features

• Rule-driven traversal engine with exact paths, single-level wildcards (*), and recursive double wildcards (**)
• Function censors with full FunctionCensorContext (matched path, rule path, root input)
• Fuzzy and case-insensitive literal key matching
• Substring redaction in nested strings via stringTests
• Regex-based path segments
• Optional console adapter (@hackylabs/deep-redact/adapters/console)
• Security guardrails: max depth and max node budget
• Graceful degradation of runtime failures with diagnostics

Migration

• From v3
• From fast-redact

Commits

• ec4744d fix(readme): regenerate for 4.0.2 version bump
• d4817ec fix(objects): class, Map, and Set value types unsupported
• d892ef1 fix(readme): regenerate for 4.0.1 version bump
• 57eabc2 chore(release): v4.0.1
• e32b3e1 fix(fast-redact and json-stringify-regex): missing footnotes
• 85b421c perf(serialised output): eliminate depth cliff with lazy path tracking
• 4925a35 perf(serialised output): reconcile circular marker semantics
• fb12409 docs(story 10.1): resolve story blockers
• e32c439 chore(performance): create bench tests for depth and scaling; and create stor...
• 0de600f chore(bench): compare against v2
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (3.0.5) was attested. Review the package versions before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)