postman-sandbox
Version:
Sandbox for Postman Scripts to run in Node.js or browser
889 lines (770 loc) • 22 kB
YAML
6.7.0:
date: 2026-05-05
new features:
- GH-1106 Added support for `pm.datasets`
6.6.1:
date: 2026-02-24
chores:
- Updated dependencies
6.6.0:
date: 2026-02-17
new features:
- >-
GH-1104 Add support for legacy response APIs without an explicit "test"
target
- >-
GH-1105 Add support for options.allowSkipRequest at execution-level and
decouple skipRequest from a fixed "prerequest" target
chores:
- Updated dependencies
6.5.0:
date: 2026-02-04
new features:
- >-
GH-1103 Add support for sandbox-execution-level disabling & enabling of
legacy APIs while respecting the top-level disableLegacyAPIs option if not
passed
6.4.0:
date: 2026-01-14
new features:
- >-
GH-1101 Add support for multiple item-type templates and explicitly passed
chai plugin in one sandbox instance
6.3.0:
date: 2025-12-01
new features:
- >-
GH-1098 Add support for avoiding default response-class casting in
`pm.execution.runRequest` return-value
6.2.2:
date: 2025-10-30
fixed bugs:
- GH-1097 Scrub `process` object in Node environment
6.2.1:
date: 2025-09-19
chores:
- Updated dependencies
6.2.0:
date: 2025-09-05
new features:
- >-
GH-1094 Add support for referencing pre-defined collection requests using
`pm.execution.runRequest`
fixed bugs:
- GH-1095 Scrub `process` object in Node environment
chores:
- Updated dependencies
6.1.2:
date: 2025-06-12
fixed bugs:
- GH-1092 Disabled support for dynamic imports in Node environment
chores:
- Updated dependencies
6.1.1:
date: 2025-04-28
fixed bugs:
- GH-1087 Restrict access to `pm` API in external packages
- GH-1086 Revert deprecation warnings for legacy packages
6.1.0:
date: 2025-03-27
new features:
- GH-1078 Added support for `pm.message` via template
fixed bugs:
- GH-1083 Fixed context inside `pm.require`
chores:
- Updated dependencies
6.0.0:
date: 2025-02-21
breaking changes:
- GH-1052 Dropped support for Node < v18
new features:
- GH-1032 Enhanced performance when operating on buffers in Node environment
- >-
GH-1035 Added missing buffer APIs to expose a uniform interface across
environments
- >-
GH-1052 Added support URL, Encoding, File, Cryptography, and Stream
globals
- GH-1049 Replaced shims for atob and btoa with native implementations
- >-
GH-1050 Deprecated `atob`, `btoa`, `backbone`, 'crypto-js' and `tv4`
libraries
- >
GH-1066 Added support for AbortController, AbortSignal, AggregateError,
DOMException, Event, EventTarget, Intl, structuredClone and queueMicrotask
globals
- GH-1051 Added support for File global
fixed bugs:
- GH-1036 Fixed `uncaughtException` event listener not being removed
- GH-1034 Fixed an issue where sandbox crashes for large response body
- GH-1052 Fixed an issue where script execution failed on Node > v22.3
chores:
- GH-1033 Update ci.yml to run coverage on latest node version
- GH-1032 Add support for configuring module resolver based on environment
- GH-1066 Update dependencies
5.1.2:
date: 2024-09-04
fixed bugs:
- GH-1040 Only allow `set`, `get` and `unset` operations on `pm.vault`
5.1.1:
date: 2024-08-01
fixed bugs:
- GH-1023 Prevented invalid Events from being executed
chores:
- Allowed access to `pm.vault` only when `vaultSecrets` is set
- Updated dependencies
5.1.0:
date: 2024-07-29
new features:
- GH-1003 Added support for `pm.vault` VariableScope
fixed bugs:
- GH-1018 Fixed warnings for all `postman.*` legacy APIs
chores:
- Updated dependencies
5.0.0:
date: 2024-06-19
breaking changes:
- GH-1004 Dropped support for Node < v16
new features:
- GH-999 Improved isolation for executing scripts
- GH-1000 Added support for top-level await in scripts
chores:
- GH-999 Bumped `uvm` dependency
- GH-1004 Updated ESLint rules
- Bumped `xml2js` to `v0.6.2`
4.7.1:
date: 2024-04-03
fixed bugs:
- GH-994 Modified process.mainModule to prevent access to the Module object
chores:
- GH-993 Moved deprecation warnings to be on the first usage of API
4.7.0:
date: 2024-04-01
new features:
- GH-987 Deprecated legacy sandbox APIs
- GH-991 Added warnings in console when legacy sandbox APIs are used
4.6.1:
date: 2024-04-01
fixed bugs:
- GH-986 Fixed the types for `pm.execution.setNextRequest`
- GH-990 Sanitized the global scope by deleting the timers properties
chores:
- Updated dependencies
4.6.0:
date: 2024-03-13
fixed bugs:
- GH-981 Dropped support for legacy sandbox APIs in packages
- GH-985 Fixed the error message shown when there is an error in packages
new features:
- |
GH-984 Added `pm.execution.setNextRequest` API, similar to legacy
`postman.setNextRequest`
chores:
- Updated dependencies
4.5.1:
date: 2024-03-12
chores:
- GH-968 Added support on demand template registration
4.5.0:
date: 2024-02-28
new features:
- GH-976 Add `pm.require` API to use packages inside scripts
4.4.0:
date: 2023-11-18
new features:
- GH-950 Added support for `pm.execution.location`
chores:
- Updated dependencies
4.3.0:
date: 2023-11-02
new features:
- GH-964 Added support for `pm.execution.skipRequest()`
chores:
- GH-965 Updated generated types
4.2.8:
date: 2023-10-19
fixed bugs:
- GH-961 Fixed `Error.prepareStackTrace` to prevent stack trace pollution
chores:
- Updated dependencies
4.2.7:
date: 2023-08-03
chores:
- Updated dependencies
4.2.6:
date: 2023-06-07
chores:
- Updated dependencies
4.2.5:
date: 2023-04-10
fixed bugs:
- GH-907 Defined `Error.prepareStackTrace` to prevent stack trace pollution
chores:
- Updated dependencies
4.2.4:
date: 2023-03-10
fixed bugs:
- Fixed memory leak due to console listeners
chores:
- Moved `serializeLogs` option to context-level instead of per-execute
4.2.3:
date: 2023-02-22
fixed bugs:
- |
GH-896 Fixed a bug where console events from previously executed scripts
were not emitted
chores:
- Updated dependencies
4.2.2:
date: 2023-01-25
chores:
- GH-886 Bumped tough-cookie dependency
- Updated dependencies
4.2.1:
date: 2023-01-20
fixed bugs:
- GH-884 Fixed memory leak due to console and cookie listeners
chores:
- GH-887 Migrate to GitHub Actions
- Updated dependencies
4.2.0:
date: 2022-11-28
new features:
- GH-872 Added support for Promise execution
- GH-874 Added support for console.clear()
chores:
- GH-875 Updated Travis configuration to use an updated Ubuntu distribution
- Updated dependencies
4.1.2:
date: 2022-08-04
fixed bugs:
- GH-849 Fixed misplaced postman-collection dependency
4.1.1:
date: 2022-08-02
chores:
- Updated dependencies
4.1.0:
date: 2022-07-28
new features:
- GH-839 [internal] Added new `createContextFleet` method
fixed bugs:
- Fixed a bug where synchronous cookie store used to bail out execution
chores:
- Updated dependencies
4.0.8:
date: 2022-06-06
chores:
- Updated dependencies
4.0.7:
date: 2022-05-24
chores:
- Run Travis coverage step in latest LTS Node.js release
- Updated dependencies
4.0.6:
date: 2022-01-03
chores:
- Updated dependencies
4.0.5:
date: 2021-08-16
chores:
- Updated dependencies
4.0.4:
date: 2021-08-09
chores:
- Updated dependencies
4.0.3:
date: 2021-06-22
chores:
- Added secure codecov publish script
- Updated dependencies
4.0.2:
date: 2021-03-24
chores:
- Updated dependencies
4.0.1:
date: 2021-01-03
chores:
- Updated dependencies
4.0.0:
date: 2020-10-07
breaking changes:
- GH-610 Dropped support for Node < v10
fixed bugs:
- GH-603 Removed access from the UVM bridge once it's in execution closure
- GH-605 Sanitized the global scope by deleting the forbidden properties
chores:
- GH-609 Bumped uvm (Web Worker bridge) and uniscope dependency
- GH-615 Used terser for bootcode compression and store as UTF-8 code string
- GH-616 Added postinstall script to override locales exported by faker
- GH-617 Moved postinstall script to cache generation
- GH-618 Automated releases and publish process
- GH-613 Converted internal function implementations to ES6 class
- GH-613 Removed uuid and inherits dependencies
- >-
GH-610 Updated .npmignore to prevent the addition of tests and config
files in the published package
- GH-610 Added system test for published package content
- GH-610 Removed puppeteer dependency for browser tests
- GH-610 Updated nyc configuration
- GH-610 Updated ESLint rules
- GH-610 Updated dependencies
3.5.9:
date: 2020-08-31
chores:
- Updated dependencies
3.5.8:
date: 2020-08-18
chores:
- GH-597 Added TypeScript Type Declaration
- Updated dependencies
3.5.7:
date: 2020-07-13
chores:
- Updated dependencies
3.5.6:
date: 2020-06-26
fixed bugs:
- >-
GH-589 Fixed a bug where asynchronous scripts are not executed in the
browser
chores:
- Updated dependencies
3.5.5:
date: 2020-06-14
chores:
- Updated dependencies
3.5.4:
date: 2020-06-05
chores:
- Updated dependencies
3.5.3:
date: 2020-03-02
chores:
- GH-513 Added `codecov` for coverage checks
- Updated dependencies
3.5.2:
date: 2019-12-02
chores:
- GH-511 Store boot code as base64 string
- GH-512 Exclude response object from execution before dispatch
- Updated dependencies
3.5.1:
date: 2019-11-13
chores:
- |
GH-507 Updated console serialize replacer to generate verbose placeholders
for non-teleported types
- Updated dependencies
3.5.0:
date: 2019-11-12
new features:
- GH-502 Added support for non-JSON compatible data types in console logs
- |
GH-502 Added option `serializeLogs` to allow sending `teleport-javascript`
serialized logs
- GH-504 Added support for functions, weakMaps, etc. in console logs
chores:
- Updated dependencies
3.4.0:
date: 2019-10-01
new features:
- GH-496 Added support for `pm.collectionVariables` VariableScope
chores:
- Updated dependencies
3.3.3:
date: 2019-09-06
chores:
- Updated dependencies
3.3.2:
date: 2019-08-14
chores:
- Updated dependencies
3.3.1:
date: 2019-08-02
chores:
- Updated dependencies
3.3.0:
date: 2019-08-01
new features:
- GH-468 Updated `pm.cookies.jar` methods
- |
GH-464 Added APIs for visualizer operations with following methods.
-> `pm.visualizer.set` - Allow setting visualizer template and its options
```
var template = '<h1>Hello, {{name}}<h1>',
data = {
name: 'Postman'
},
options = {
// options to use while processing the template
};
pm.visualizer.set(template, data, options);
```
-> `pm.visualizer.clear` - Removes previously set visualizer template and its options
```
pm.visualizer.set(template, data, options);
pm.visualizer.clear(); // will remove set template in above line
```
chores:
- Updated dependencies
3.2.9:
date: 2019-06-17
chores:
- Bumped `postman-collection` to `v3.5.0`
3.2.8:
date: 2019-06-07
chores:
- Bumped `postman-collection` to `v3.4.9`
- Updated dependencies
3.2.7:
date: 2019-04-26
new features:
- |
Added support for adding asynchronous tests when using `pm.test` by
passing `done` callback
```
// example of asynchronous test
pm.test('this is a test name', function (done) {
// do some async stuff here and call `done`
pm.sendRequest(done);
});
```
- |
Added `history` argument to callback of pm.sendRequest() which contains
received cookies in response
```
// use of `history` argument
pm.sendRequest(url, function(err, res, history) {
console.log(history.cookies.all());
});
```
- >-
Added CookieJar to pm.cookies which dispatches CookieStore event
`execution.cookies.${id}` and expects `execution.cookies.${id}`
chores:
- Updated dependencies
3.2.6:
date: 2019-03-19
chores:
- Bumped `postman-collection` to `v3.4.6`
3.2.5:
date: 2019-03-01
chores:
- Bumped `postman-collection` to `v3.4.5`
- Bumped `uvm` to `v1.7.5`
3.2.4:
date: 2019-02-20
chores:
- Bumped `postman-collection` to `v3.4.4`
3.2.3:
date: 2019-02-1
chores:
- Bumped `postman-collection` to `v3.4.2`
3.2.2:
date: 2019-01-3
chores:
- Updated dependencies
3.2.1:
date: 2018-12-25
fixed bugs:
- >-
Updated `chai-postman` to `v1.1.1`, which fixes a JSON schema assertion
bug
3.2.0:
date: 2018-12-24
new features:
- GH-373 Added Ajv JSON schema validator
- Deprecated tv4 in favor of Ajv
fixed bugs:
- GH-374 Fixed a bug that caused negated assertions to persist
chores:
- Migrated tests to chai expect assertions
- Updated dependencies
3.1.3:
date: 2018-09-21
chores:
- Updated dependencies
3.1.2:
date: 2018-08-20
chores:
- Updated dependencies
3.1.1:
date: 2018-06-30
fixed bugs:
- >-
Fixed a bug that caused executions to crash when context variables have
tracked mutations
3.1.0:
date: 2018-06-28
new features:
- >-
Added change tracking to sandbox variables. Now execution result has
`mutations` which has recorded all the changes that were made during the
script execution.
chores:
- Updated dependencies
3.0.8:
date: 2018-05-24
chores:
- Updated dependencies
3.0.7:
date: 2018-05-16
chores:
- Updated dependencies
3.0.6:
date: 2018-04-10
fixed bugs:
- 'Reverted GH-273: Chai assignment fix'
3.0.5:
date: 2018-04-9
fixed bugs:
- Fixed a bug that caused negated assertions to persist
- >-
Updated `uvm` to `v1.7.1`, which fixes iframe bootcode loading for large
bundles
- >-
Updated `chai-postman` to `v1.0.2`, which fixes a response status
assertion bug
chores:
- Updated dependencies
3.0.4:
date: 2017-11-30
chores:
- Updated dependencies
3.0.3:
date: 2017-11-20
new features:
- |
Get and set objects in variables with `json` type
// set objects as values for `json types`
pm.variables.set('myObject', { version: 'v1' }, 'json');
// get object values
console.log(pm.variables.get('myObject')); // { version: 'v1' }
console.log(typeof pm.variables.get('myObject')); // object
3.0.2:
date: 2017-11-9
chores:
- Made error messages for legacy test failure assertions useful
3.0.1:
date: 2017-11-8
fixed bugs:
- >-
Fixed a bug where assertions for legacy test failures did not include the
assertion `error`
chores:
- Updated dependencies
3.0.0:
date: 2017-11-7
breaking changes:
- >-
`execution.assertion` and `execution.assertions.${id}` events are now
passed with array of assertions
- Added support for collection variables using `collectionVariables`
- >-
Variables set with `pm.variables` state are now bubbled with
`execution.result.${id}` as `_variables`
chores:
- Updated dependencies
2.3.5:
date: 2017-10-13
new features:
- >-
GH-212 Replaced in-house chai assertion extensions with chai-postman
(https://github.com/postmanlabs/chai-postman)
chores:
- Updated dependencies
2.3.4:
date: 2017-09-27
fixed bugs:
- GH-203 Fixed a bug that caused internal assertion helpers to be leaked
- >-
GH-196 Shifted `browserify` to `devDependencies`, thereby reducing package
size
- GH-193 Fixed script timeout bug
- GH-186 Added support for `console.error`
2.3.3:
date: 2017-08-28
chores:
- GH-178 Bumped `xml2js` to `v0.4.19`
- GH-180 Bumped `postman-collection` to `v2.1.3`
2.3.2:
date: 2017-08-21
fixed bugs:
- >-
GH-176 Fixed an issue that caused missing headers in assertions to crash
test scripts
chores:
- GH-156 Updated `csv-parse` to v1.2.1
2.3.1:
date: 2017-08-18
new features:
- GH-106 Support for timers inside sandbox (not in browser)
- Added `url`, `punycode`, and `querystring` to the Sandbox
- >-
Added `pm.sendRequest` which dispatches event `execution.request.${id}`
and expects `execution.response.${id}`
fixed bugs:
- >-
GH-169 Prevented disabled headers from showing up in `request.headers` in
the sandbox
- >-
Fixed bug where `pm.test` called without an assertion function would not
trigger assertion event
chores:
- Updated dependencies
2.3.0:
date: 2017-06-27
new features:
- GH-133 Added csv-parse (synchronous) to the sandbox
chores:
- Updated dependencies
2.2.0:
date: 2017-06-14
new features:
- GH-122 Added moment (without locales) to the Sandbox
chores:
- Updated dependencies
2.1.5:
date: 2017-05-16
fixed bugs:
- >-
Fixed bug that caused an invalid version of Collection SDK to be cached on
prepublish
2.1.4:
date: 2017-05-15
chores:
- update postman-collection to version 1.2.5
2.1.3:
date: 2017-05-12
new features:
- Introduced `pm.variables` as a unified interface for variable access
- Renamed `pm.data` to `pm.iterationData`, exposed as a `VariableScope`
fixed bugs:
- >-
Updated `uniscope` to v1.1.1, which contains a bugfix for handling falsey
globals
2.1.2:
date: 2017-05-8
fixed bugs:
- GH-89 Assertion event indices now begin with `0`
2.1.1:
date: 2017-04-25
new features:
- >-
Added request and response assertions in form of `pm.request.to` and
`pm.response.to`
- '`pm.cookies` is now available'
2.1.0:
date: 2017-04-13
new features:
- Initial release of the `pm` API
- >-
`pm.globals`, `pm.environment` - VariableScope
(http://www.postmanlabs.com/postman-collection/VariableScope.html)
- >-
`pm.request` - Request
(http://www.postmanlabs.com/postman-collection/Request.html)
- >-
`pm.response` - Response
(http://www.postmanlabs.com/postman-collection/Response.html) (only
available in test scripts)
2.0.0:
date: 2017-04-05
breaking changes:
- >-
Removed legacy handling of environment and collections (both are now
`VariableScope`s
- Introduced a standardized execution result object, `Execution`
- Removed the `masked` options which were used by the sandbox
1.0.1:
date: 2017-01-06
new features:
- >-
Shifted to deprecated `new Buffer()` function for full node v4
compatibility
- Tests for BOM support in JSON.parse
chores:
- Dependency shift from optional dependencies to dev dependencies
1.0.0:
date: 2016-12-29
fixed bugs:
- Fixed missing clear immediate
0.0.1-beta.11:
date: 2016-12-27
fixed bugs:
- Added the missing clearImmediate stub timer
0.0.1-beta.10:
date: 2016-12-27
new features:
- Sandbox library tests
- Added stub timer functions that do nothing except trigger console message
- >-
Compatibility with Postman Legacy sandbox framework (and other
improvements)
fixed bugs:
- Fix binding issue of the stub timers
- User error and informational console events
- Replaced deprecated buffer-browserify with feross buffer and added tests
- >-
Fixed issue with XMLHttpRequest variable name being incorrect inside
sandbox
0.0.1-beta.9:
date: 2016-12-21
new features:
- Added UVM with external iframe support for sandboxed chrome packaged apps
0.0.1-beta.8:
date: 2016-12-20
new features:
- Added additional relaxations of sandbox + jQuery for browser variant
- Updated UVM to beta version which supports timeouts
- Added tests to check state of optional dependencies
- Update to accept parameter changes in UVM
0.0.1-beta.7:
date: 2016-12-16
fixed bugs:
- Made Postman execute use a common scope object
- Fix crypto-js dependency release issue.
0.0.1-beta.6:
date: 2016-12-2
new features:
- Made all executions follow legacy IO structure
- Added fully functional PostmanConsole inside library
fixed bugs:
- Bugfix using loads merge instead of assign!
- Updated uniscope to a non buggy unjailed mode version
- >-
Ensured that xml2js is exposed as xml2Json instead of original library
inside sandbox
0.0.1-beta.5:
date: 2016-12-1
new features:
- Added test for loads library inside sandbox
- Made default bundling option detect globals
- >-
Moved requirement of sandbox globals to inside scope execution and ran it
in unjailed mode
fixed bugs:
- Fixed bug with context.dispose trying to access undefined variable
0.0.1-beta.4:
date: 2016-11-30
new features:
- Added console support
- Added polymorphism to the data argument of execution
- Made execution debug options be inherited during construction
- Made the sandbox execute event accept the current (legacy) data format
- Made sandbox load files relative to itself
0.0.1-beta.3:
date: 2016-11-30
new features:
- Made the file loading of bundler use absolute path
- Move vendor out one level
0.0.1-beta.2:
date: 2016-11-30
new features:
- Made the dependency on bundling not be needed if cache is present
- Added pre-publish script for initial testing
0.0.1-beta.1:
date: 2016-11-30
initial release:
- Added initial codebase
- Added boilerplate configuration files.