@blamejs/blamejs-shop 0.1.37 → 0.2.0

package/lib/vendor/blamejs/lib/auth/oauth.js

@@ -1008,7 +1008,7 @@ function create(opts) {
       throw new OAuthError("auth-oauth/no-id-token", "verifyIdToken: idToken must be a string");
     }
     var parts = idToken.split(".");
-    // CVE-2026-29000 / CVE-2026-22817 / CVE-2026-23993 — mirror
+    // CVE-2026-29000 / CVE-2026-22817 — mirror
     // jwt-external's 5-segment JWE refusal. A 5-segment compact
     // serialization is a JWE (RFC 7516); verifyIdToken is a JWS verifier
     // and a JWE shape reaching here is the confused-deputy class an OP
@@ -1023,7 +1023,7 @@ function create(opts) {
       }); } catch (_e) { /* drop-silent — observability sink */ }
       throw new OAuthError("auth-oauth/jwe-refused",
         "5-segment JWE id_token refused — verifyIdToken only handles JWS " +
-        "(CVE-2026-29000 / CVE-2026-23993 / CVE-2026-22817 / CVE-2026-34950 JWE-bypass class)");
+        "(CVE-2026-29000 / CVE-2026-22817 / CVE-2026-34950 JWE-bypass class)");
     }
     if (parts.length !== 3) {
       throw new OAuthError("auth-oauth/malformed-jwt", "ID token does not have 3 parts");
@@ -1039,13 +1039,14 @@ function create(opts) {
     if (!header || typeof header.alg !== "string") {
       throw new OAuthError("auth-oauth/malformed-jwt", "ID token header missing 'alg'");
     }
-    // CVE-2026-23993 — refuse unknown alg BEFORE any key resolution.
+    // Alg-allowlist gate (CWE-347 / CWE-757) — refuse unknown alg BEFORE
+    // any key resolution.
     // The acceptedAlgorithms list is the operator's posture; an alg
     // outside it never reaches the JWKS lookup or node:crypto.verify.
     if (acceptedAlgorithms.indexOf(header.alg) === -1) {
       throw new OAuthError("auth-oauth/alg-not-accepted",
         "ID token signed with '" + header.alg + "' which is not in the accepted-algorithm list " +
-        "(CVE-2026-23993 — refused before key lookup)");
+        "(alg-allowlist gate — refused before key lookup)");
     }
     // RFC 7515 §4.1.11 — refuse JWS with `crit` header. Every other
     // verifier in the framework (jwt.js, jwt-external.js, dpop.js)
@@ -1344,8 +1345,8 @@ function create(opts) {
     }
     var iss = u.searchParams.get("iss");
     var sid = u.searchParams.get("sid");
-    // RFC 0 invariant: `iss` MUST match the configured issuer when
-    // present (defends against an attacker-controlled IdP forging a
+    // OpenID Connect Front-Channel Logout 1.0 §3: `iss` MUST match the
+    // configured issuer when present (defends against an attacker-controlled IdP forging a
     // logout for a session at a different IdP). `sid` is required
     // when the RP registered with frontchannel_logout_session_required=true;
     // we surface it either way and let the operator decide.

package/lib/vendor/blamejs/lib/auth/oid4vci.js

@@ -108,14 +108,14 @@ function _verifyProofJwt(proofJwt, expectedAud, expectedCNonce, expectedClientId
     throw new AuthError("auth-oid4vci/wrong-proof-typ",
       "credential issuance: proof JWT typ must be \"openid4vci-proof+jwt\" (got \"" + header.typ + "\")");
   }
-  // CVE-2026-23993 — refuse unknown / unsupported alg BEFORE any
-  // verify-side work. The supportedAlgs list is the issuer's posture;
+  // Alg-allowlist gate (CWE-347 / CWE-757) — refuse unknown / unsupported
+  // alg BEFORE any verify-side work. The supportedAlgs list is the issuer's posture;
   // refusing here mirrors the discipline in oauth.verifyIdToken /
   // jwt-external.verifyExternal.
   if (!header.alg || supportedAlgs.indexOf(header.alg) === -1) {
     throw new AuthError("auth-oid4vci/unsupported-proof-alg",
       "credential issuance: proof JWT alg \"" + header.alg + "\" not in issuer-supported set " +
-      "(CVE-2026-23993 — refused before key lookup)");
+      "(alg-allowlist gate — refused before key lookup)");
   }
   // AUTH-5 / RFC 7515 §4.1.11 — refuse non-empty `crit`. Pre-v0.9.x
   // silently ignored, letting an attacker-controlled wallet declare

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -453,12 +453,14 @@ function create(opts) {
 
     // XSW defense — refuse duplicate top-level security-critical
     // elements. SAML XML signature wrapping (XSW) attacks shuffle
-    // signed elements alongside unsigned siblings; the parser's
-    // first-match `_findChild` lookup combined with the signed-
-    // element-ID check at L479 was vulnerable to a multi-Assertion
-    // payload where the verifier signed one but the consumer read
-    // attributes from another. Reject any Response with more than
-    // one of these structural children (Audit 2026-05-11).
+    // signed elements alongside unsigned siblings; a first-match
+    // child lookup combined with a signed-element-ID check is
+    // vulnerable to a multi-Assertion payload where the verifier
+    // signs one element but the consumer reads attributes from
+    // another. This is the class behind CVE-2024-45409 (ruby-saml,
+    // CVSS 10.0, actively exploited) and CVE-2025-25291/25292
+    // (omniauth-saml / ruby-saml namespace-confusion XSW). Reject
+    // any Response with more than one of these structural children.
     var statusChildren = _findAllChildren(root, "Status", SAML_NS.protocol);
     if (statusChildren.length > 1) {
       throw new AuthError("auth-saml/duplicate-status",
@@ -1531,9 +1533,10 @@ function create(opts) {
 //     http://www.w3.org/2009/xmlenc11#rsa-oaep          (XMLEnc 1.1 §5.4.2)
 //
 // AES-CBC content encryption (xmlenc#aes128-cbc / aes256-cbc) is
-// intentionally REFUSED: CVE-2011-1473 + the broader XML-Encryption
-// padding-oracle research (Jager & Somorovsky 2011) demonstrate that
-// CBC mode under XMLEnc is exploitable without per-content MAC.
+// intentionally REFUSED: the XML-Encryption padding-oracle research
+// (Jager & Somorovsky, "How to Break XML Encryption", CCS 2011)
+// demonstrates that CBC mode under XMLEnc is exploitable without per-
+// content MAC.
 // Operators integrating with IdPs that default to CBC (older ADFS /
 // Azure AD / Okta / Keycloak / OneLogin) MUST switch the IdP's
 // content-encryption setting to AES-128-GCM or AES-256-GCM. The
@@ -1543,7 +1546,7 @@ function create(opts) {
 //
 // SHA-1 anywhere (rsa-oaep-mgf1p with SHA-1 OAEP DigestMethod,
 // xmldsig#sha1 DigestMethod) is also refused — Bleichenbacher /
-// collision risk plus CVE-2023-49141-class advisories outweigh
+// collision risk plus CVE-2023-49141 class advisories outweigh
 // "interop with stale IdPs". Operators upgrade the IdP's digest
 // algorithm to SHA-256+ rather than relax the framework defense.
 //
@@ -1606,7 +1609,7 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
     }
     if (oaepHashName === "sha1") {
       throw new AuthError("auth-saml/encrypted-weak-oaep-digest",
-        "EncryptedKey OAEP DigestMethod is SHA-1 — refused (CVE-2023-49141-class). " +
+        "EncryptedKey OAEP DigestMethod is SHA-1 — refused (CVE-2023-49141 class). " +
         "Require SHA-256+ on IdP side.");
     }
     var spKey;
@@ -1710,7 +1713,7 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
       "(supported: W3C xmlenc11#aes128-gcm, xmlenc11#aes256-gcm, " +
       "framework-experimental urn:blamejs:experimental:xmlenc:xchacha20-poly1305). " +
       "AES-CBC content encryption is refused — switch the IdP to AES-128-GCM or AES-256-GCM " +
-      "(CVE-2011-1473 padding-oracle class).");
+      "(XMLEnc CBC padding-oracle class, Jager & Somorovsky CCS 2011).");
   }
   return clearBytes.toString("utf8");
 }

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -441,15 +441,15 @@ async function verify(presentation, opts) {
       "verify: malformed JWT header: " + e.message);
   }
   var alg = headerObj.alg;
-  // CVE-2026-23993 — refuse unknown / unsupported alg BEFORE any key
-  // resolution. The shared `_assertAlgKtyMatch` helper repeats this
+  // Alg-allowlist gate (CWE-347 / CWE-757) — refuse unknown / unsupported
+  // alg BEFORE any key resolution. The shared `_assertAlgKtyMatch` helper repeats this
   // check after the issuer key is resolved; doing it here too closes
   // the gap where an issuerKeyResolver with side effects (network
   // fetch, audit emit) would run even when the alg is unsupported.
   if (typeof alg !== "string" || SUPPORTED_ALGS.indexOf(alg) === -1) {
     throw new AuthError("auth-sd-jwt-vc/unsupported-alg",
       "verify: header alg \"" + alg + "\" not in supported set " +
-      "(CVE-2026-23993 — refused before key lookup)");
+      "(alg-allowlist gate — refused before key lookup)");
   }
   // draft-ietf-oauth-sd-jwt-vc §3.1 — typ MUST be `vc+sd-jwt` (or
   // `dc+sd-jwt` for digital-credential profile). Pre-v0.9.x the absent-

package/lib/vendor/blamejs/lib/backup/index.js

@@ -1028,9 +1028,8 @@ module.exports = {
  * Adapter-driven storage backend. Wraps the bundle directory's file
  * tree into per-file key-value pairs routed through an operator-
  * supplied byte-store adapter so backup bundles can land anywhere
- * that exposes the contract (local fs is the v0.12.7 default; tar
- * folding lands v0.12.8, tar.gz v0.12.9, S3/MinIO/Azure/GCS
- * objectStore v0.12.11).
+ * that exposes the contract: local fs (the default), tar / tar.gz
+ * folding, and S3 / MinIO / Azure / GCS objectStore adapters.
  *
  * The adapter contract (small surface; an `fs` implementation is the
  * default + ships in `lib/backup/_adapter-fs.js`):

package/lib/vendor/blamejs/lib/calendar.js

@@ -354,7 +354,14 @@ function validate(jsCal) {
  *   // → { "@type":"Event", uid:"a@b", updated:"2026-05-21T10:00:00Z", ... }
  */
 function fromIcal(text, opts) {
-  var ast = safeIcal.parse(text, opts || {});
+  // Forward parser options to b.safeIcal.parse. Accept BOTH the
+  // documented nested form (`{ safeIcalOpts: { profile, caps, ... } }`)
+  // AND the historically-working top-level form (`{ profile: "balanced" }`)
+  // so neither caller regresses; the nested form wins on conflict. The
+  // `safeIcalOpts` wrapper key itself is stripped before forwarding.
+  var icalOpts = Object.assign({}, opts || {}, (opts && opts.safeIcalOpts) || {});
+  delete icalOpts.safeIcalOpts;
+  var ast = safeIcal.parse(text, icalOpts);
   var events   = (ast && ast.vcalendar && ast.vcalendar.vevent)   || [];
   var todos    = (ast && ast.vcalendar && ast.vcalendar.vtodo)    || [];
   var journals = (ast && ast.vcalendar && ast.vcalendar.vjournal) || [];
@@ -515,7 +522,7 @@ function toIcal(jsCal, opts) {
  * timestamps in the operator's `[from, to]` window. Returns an array
  * of ISO 8601 UTC strings (`yyyy-mm-ddTHH:MM:SSZ`). Bounded by
  * `MAX_EXPAND_INSTANCES` (4096) + `MAX_EXPAND_SPAN_MS` (10 years) to
- * defend against CVE-2024-39687-class recurrence-bomb expansion.
+ * defend against the RRULE recurrence-bomb expansion class.
  *
  * v1 supports FREQ=DAILY/WEEKLY/MONTHLY/YEARLY with INTERVAL, COUNT,
  * UNTIL. BYDAY / BYMONTH / BYMONTHDAY / BYWEEKNO / BYYEARDAY /

package/lib/vendor/blamejs/lib/circuit-breaker.js

@@ -42,10 +42,11 @@ var retryHelper = require("./retry");
  * with the framework's `create(opts)` vocabulary.
  *
  * The `CIRCUIT_OPEN` error code is a pre-v1 artifact — every other
- * framework error class uses namespaced codes (`retry/...`). The
- * rename is deferred to v0.10 with a deprecation cycle so existing
- * operators who match `err.code === "CIRCUIT_OPEN"` aren't broken
- * in a patch.
+ * framework error class uses namespaced codes (`retry/...`). It is
+ * kept through the pre-1.0 line so existing operators who match
+ * `err.code === "CIRCUIT_OPEN"` aren't broken in a patch; the rename
+ * to a namespaced code lands at v1.0 alongside the namespaced-error
+ * sweep, with a deprecation warning shipping a minor ahead.
  *
  * @opts
  *   name:             string,    // identifier used in audit + state-change events

package/lib/vendor/blamejs/lib/cose.js

@@ -41,9 +41,10 @@
  *   2) listing a header label the verifier does not understand is
  *   refused (RFC 9052 §3.1) — a crit-bypass defense.
  *
- *   v1 ships COSE_Sign1 (single-signer) with an attached payload.
- *   Detached payload, COSE_Sign (multi-signer), COSE_Mac0, and
- *   COSE_Encrypt are deferred-with-condition (operator demand).
+ *   Ships COSE_Sign1 (single-signer, attached payload), COSE_Mac0, and
+ *   COSE_Encrypt0 (single-recipient AEAD). Detached payload, COSE_Sign
+ *   (multi-signer), and COSE_Encrypt (multi-recipient) are
+ *   deferred-with-condition (operator demand).
  *
  * @card
  *   COSE_Sign1 sign / verify (RFC 9052) over the in-tree CBOR codec —

package/lib/vendor/blamejs/lib/crypto-hpke.js

@@ -5,7 +5,7 @@
  * Suite (PQC-first per framework crypto policy):
  *   KEM:    ML-KEM-1024 (FIPS 203) — post-quantum encapsulation
  *   KDF:    HKDF-SHA3-512
- *   AEAD:   ChaCha20-Poly1305 (RFC 7539)
+ *   AEAD:   ChaCha20-Poly1305 (RFC 8439, obsoletes RFC 7539)
  *
  * The classical HPKE suites in RFC 9180 §7 (DHKEM with X25519 / P-256 /
  * P-384 / P-521 + HKDF-SHA256/384/512 + AES-GCM/ChaCha20) are NOT

package/lib/vendor/blamejs/lib/crypto-oprf.js

@@ -30,14 +30,14 @@
  *   <code>suite(name)</code> returns the suite for one of the RFC 9497
  *   ciphersuites — <code>ristretto255-sha512</code> (the Privacy Pass
  *   default), <code>p256-sha256</code>, <code>p384-sha384</code>, or
- *   <code>p521-sha512</code> — each exposing the three modes. Group and
+ *   <code>p521-sha512</code> — each exposing both shipped modes. Group and
  *   hash-to-curve operations come from the vendored <code>@noble/curves</code>.
  *   Byte arguments are <code>Uint8Array</code> / <code>Buffer</code>;
  *   returned elements and outputs are <code>Uint8Array</code>.
  *
  * @card
  *   RFC 9497 Oblivious PRFs — learn <code>F(key, input)</code> without the
- *   server seeing the input (oprf / voprf / poprf modes; ristretto255 / P-256
+ *   server seeing the input (oprf / voprf modes; ristretto255 / P-256
  *   / P-384 / P-521 suites). The primitive behind Privacy Pass, password
  *   hardening, and private set intersection.
  */

package/lib/vendor/blamejs/lib/crypto.js

@@ -789,7 +789,7 @@ function toBase64Url(buf) {
  *
  * Strict mode (default) refuses non-canonical input — chars outside
  * the RFC 4648 §5 alphabet, length-mod-4-of-1, mixed `+/` from
- * standard base64, trailing garbage. Defends a CVE-2022-0235-class
+ * standard base64, trailing garbage. Defends a CVE-2022-0235 class
  * footgun where Node's permissive decoder silently tolerated
  * tampered JWT signatures. Operators with a documented lossy legacy
  * payload opt out per call via `{ strict: false }`.
@@ -817,7 +817,7 @@ function fromBase64Url(s, opts) {
   // OAuth `state` round-tripping) MUST reject non-canonical / malformed
   // input. The Node base64url decoder silently tolerates trailing
   // garbage, mixed `+/` from standard base64, missing padding errors,
-  // and length-mod-4 shapes — CVE-2022-0235-class footgun. Strict mode
+  // and length-mod-4 shapes — CVE-2022-0235 class footgun. Strict mode
   // (the default) refuses anything outside the RFC 4648 §5 alphabet +
   // length rules. Operators with a known-lossy legacy payload pass
   // `{ strict: false }` to opt out per call.

package/lib/vendor/blamejs/lib/framework-error.js

@@ -290,7 +290,8 @@ var GuardTimeError        = defineClass("GuardTimeError",        { alwaysPermane
 var GuardMimeError        = defineClass("GuardMimeError",        { alwaysPermanent: true });
 // GuardJwtError covers JWT identifier violations: shape malformation
 // (not 3 base64url segments), alg=none refuse (canonical CVE-class —
-// CVE-2015-9235 jsonwebtoken / CVE-2018-0114 java-jwt), alg-allowlist
+// CVE-2015-9235 jsonwebtoken alg:none / CVE-2018-0114 Cisco node-jose
+// embedded-JWK key confusion), alg-allowlist
 // drift, kid path-traversal (operator keyResolver path-injection
 // class), typ confusion, oversized header / payload / signature,
 // exp / nbf / iat sanity, missing required claims, unknown crit

package/lib/vendor/blamejs/lib/guard-jwt.js

@@ -16,8 +16,9 @@
  *
  *   Algorithm-confusion defense: `alg=none` is universally refused
  *   at every profile (RFC 7518 §3.6 explicit-no-signature, the
- *   canonical CVE-2015-9235 jsonwebtoken / CVE-2018-0114 java-jwt
- *   class). The operator-supplied `allowedAlgs` allowlist defaults
+ *   canonical CVE-2015-9235 jsonwebtoken alg:none / CVE-2018-0114
+ *   Cisco node-jose embedded-JWK confusion class). The
+ *   operator-supplied `allowedAlgs` allowlist defaults
  *   to the framework's PQC-first set (ML-DSA-87 / ML-DSA-65 /
  *   ML-DSA-44 / SLH-DSA-SHAKE-256{f,s} / SLH-DSA-SHA2-256{f,s} /
  *   EdDSA / ES* / RS* / PS*) so HS256-against-RSA-public-key

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -493,7 +493,7 @@ function gate(opts) {
  *
  * Scan a DATA-body byte buffer for the SMTP smuggling shape per
  * CVE-2023-51764 (Postfix), CVE-2023-51765 (Sendmail), CVE-2023-51766
- * (Exim), CVE-2024-32178 (.NET System.Net.Mail). RFC 5321 §2.3.8
+ * (Exim). RFC 5321 §2.3.8
  * mandates canonical CRLF line termination; the smuggling exploit
  * relies on parsers that accept `\n.\n` (bare LF before / after the
  * dot) as an alternate body terminator and then resume parsing the
@@ -517,7 +517,7 @@ function detectBodySmuggling(buf) {
     throw new GuardSmtpCommandError("guard-smtp-command/bad-input",
       "detectBodySmuggling: input must be a Buffer");
   }
-  // The CVE-2023-51764 / 51765 / 51766 / 2024-32178 class is any
+  // The CVE-2023-51764 / 51765 / 51766 class is any
   // dot-line whose line boundary is anything OTHER than canonical
   // \r\n on BOTH sides of the dot. The canonical-and-only terminator
   // is `\r\n.\r\n`. Every other shape that some receiver might honor

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -1858,8 +1858,8 @@ function dmarcParseAggregateReport(input, opts) {
       // "stream is malformed" (operator-level diagnostic) so audit/
       // alert wiring can react differently. Node surfaces the bomb
       // case with ERR_BUFFER_TOO_LARGE / "Output length exceeded the
-      // limit" / the explicit `maxOutputLength` code. CVE-class:
-      // CVE-2024-zlib decompression amplification.
+      // limit" / the explicit `maxOutputLength` code. Defends the
+      // decompression-amplification class (CWE-409 / CVE-2025-0725).
       var msg = (e && e.message) || String(e);
       var isBomb = (e && (e.code === "ERR_BUFFER_TOO_LARGE" ||
                           e.code === "ERR_OUT_OF_RANGE")) ||

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -663,7 +663,7 @@ function _parseSignaturePacket(packetBytes) {
   if (hashAlg !== HASH_ALG_SHA256 && hashAlg !== HASH_ALG_SHA512) {
     throw new MailCryptoError("mail-crypto/pgp/bad-hash",
       "hash alg " + hashAlg + " refused; only SHA-256 (8) and SHA-512 (10) are accepted. " +
-      "SHA-1 (id=2) refused per SHAttered (CVE-2017-9006-class).");
+      "SHA-1 (id=2) refused per SHAttered (2017 SHA-1 collision).");
   }
   var hashedSubLen = body.readUInt16BE(4);
   if (6 + hashedSubLen > body.length) {

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -21,9 +21,9 @@
  *   second part as base64-encoded DER.
  *
  *   Posture (when the surface lights up):
- *     - Refuses SHA-1 as the signature hash (CVE-2017-9006-class —
- *       PKCS#7 collision attacks against legacy S/MIME) and as the
- *       certificate signature algorithm.
+ *     - Refuses SHA-1 as the signature hash (SHAttered, 2017 — practical
+ *       SHA-1 collision; RFC 8551 §2.5 mandates SHA-256+ for S/MIME) and
+ *       as the certificate signature algorithm.
  *     - Refuses RSA keys < 2048 bits (RFC 8301 §3.1 — same posture
  *       as the rest of the mail surface).
  *     - Refuses MD5 anywhere (the historical S/MIME-v2 default; long
@@ -87,8 +87,8 @@
  * CVE citations:
  *   - CVE-2017-17688 / CVE-2017-17689 (EFAIL — S/MIME variant; informs
  *     the encrypt+decrypt deferral when that surface lights up)
- *   - CVE-2017-9006 (PKCS#7 / S/MIME signature-validation bypass
- *     class — informs the SHA-1 refusal posture)
+ *   - SHAttered (2017 practical SHA-1 collision) + RFC 8551 §2.5 (SHA-256
+ *     floor for S/MIME) — inform the SHA-1 signature-hash refusal posture
  *   - CVE-2018-5407 (PortSmash — informs the side-channel hardening
  *     posture when private operations land in v2)
  */
@@ -109,7 +109,7 @@ var MailCryptoError = defineClass("MailCryptoError", { alwaysPermanent: true });
 // hand-copying strings. These reflect RFC 8551 §2.5 + RFC 8301 floors.
 var RSA_MIN_BITS = 2048;                                                          // allow:raw-byte-literal — RFC 8301 §3.1
 var ALLOWED_HASHES = ["sha256", "sha384", "sha512"];
-var REFUSED_HASHES = ["md5", "sha1"];                                             // allow:raw-byte-literal — CVE-2017-9006-class
+var REFUSED_HASHES = ["md5", "sha1"];                                             // allow:raw-byte-literal — SHAttered / RFC 8551 §2.5
 
 // PROFILES + COMPLIANCE_POSTURES — the framework's standard cross-
 // primitive contract. sign() and verify() (live since v0.10.16) read
@@ -708,7 +708,7 @@ function checkCert(opts) {
       throw new MailCryptoError("mail-crypto/smime/refused-hash",
         "cert signature algorithm '" + sigAlgName +
         "' refused — SHA-1 / MD5 in cert signatures is forbidden " +
-        "(CVE-2017-9006-class). Acceptable hashes: " + ALLOWED_HASHES.join(", "));
+        "(SHAttered SHA-1 collision; RFC 8551 §2.5). Acceptable hashes: " + ALLOWED_HASHES.join(", "));
     }
   }
 

package/lib/vendor/blamejs/lib/mail-crypto.js

@@ -62,7 +62,7 @@
  *
  * CVE citations:
  *   - CVE-2017-17688 / CVE-2017-17689 (EFAIL)
- *   - CVE-2017-9006 (PKCS#7 / S/MIME signature-validation bypass class)
+ *   - SHAttered (2017 SHA-1 collision) + RFC 8551 §2.5 — SHA-1 signature-hash refusal
  */
 
 var pgp   = require("./mail-crypto-pgp");

package/lib/vendor/blamejs/lib/mail-dav.js

@@ -112,8 +112,9 @@
  *   ## CVE defense composition
  *
  *   - `b.safeIcal` rejects RRULE COUNT > 10000 / BYxxx list > 24 →
- *     defends CVE-2024-39687 (ical4j RRULE recursion / Outlook
- *     calendar bomb) on the PUT path.
+ *     defends the ical4j RRULE-recursion / recurrence-expansion DoS
+ *     class (unbounded RRULE expansion exhausts CPU/memory) on the
+ *     PUT path.
  *   - `b.xmlC14n.parse` rejects DOCTYPE / ENTITY in the
  *     PROPFIND / REPORT body → defends XXE / billion-laughs on the
  *     query path.
@@ -125,7 +126,7 @@
  *   mount under their HTTP router. Composes b.safeIcal / b.safeVcard
  *   for PUT-body validation, b.xmlC14n.parse for PROPFIND / REPORT
  *   bodies. Per-principal URL isolation; operator-supplied storage
- *   backend. Defends CVE-2024-39687 at the PUT boundary.
+ *   backend. Defends the RRULE-recursion expansion-DoS class at the PUT boundary.
  */
 
 var lazyRequire = require("./lazy-require");
@@ -749,7 +750,7 @@ function create(opts) {
       return _refuseStatus(res, 400, "PUT requires a component path");
     }
     var bodyBuf = await _readBodyBytes(req);
-    // Validate iCal body via safeIcal — defends CVE-2024-39687 at the
+    // Validate iCal body via safeIcal — defends the RRULE-recursion expansion-DoS class at the
     // ingest boundary.
     try {
       safeIcal.parse(bodyBuf, {

package/lib/vendor/blamejs/lib/mail-deploy.js

@@ -527,8 +527,9 @@ function autoDiscoverXml(opts) {
 //     brotli or the in-progress UTA-draft requires it.
 
 // Hard caps — defensive against CVE-2025-0725 (libcurl/zlib
-// integer overflow), CVE-2024-zlib decompression amplification, and
-// the §5.2 community ceiling (receivers commonly cap at 10 MiB).
+// integer overflow) and the decompression-amplification class
+// (CWE-409), plus the §5.2 community ceiling (receivers commonly cap
+// at 10 MiB).
 var TLSRPT_MAX_COMPRESSED_BYTES   = C.BYTES.mib(4);                                                   // allow:raw-byte-literal — 4 MiB compressed cap per §5.2 community practice
 var TLSRPT_MAX_DECOMPRESSED_BYTES = C.BYTES.mib(32);                                                  // allow:raw-byte-literal — 32 MiB decompressed cap (operators override via opts)
 var TLSRPT_MAX_RATIO              = 50;                                                               // allow:raw-byte-literal — 50:1 compression ratio refusal

package/lib/vendor/blamejs/lib/mail-server-imap.js

@@ -53,7 +53,7 @@
  *     pipelined command queued before TLS is refused with
  *     `BAD Pipelined post-STARTTLS not permitted`.
  *
- *   - **Literal-injection (CVE-2018-19518 INC IMAP class)** —
+ *   - **Literal-injection / command-continuation smuggling** —
  *     `{n}` literal continuation MUST come on a line of its own
  *     (per `b.guardImapCommand.detectLiteralSmuggling`); oversize
  *     literals refused (default 64 MiB); LITERAL+ (RFC 7888) non-

package/lib/vendor/blamejs/lib/mail-server-jmap.js

@@ -95,18 +95,18 @@
  *     - `urn:ietf:params:jmap:error:accountNotFound`
  *     - `urn:ietf:params:jmap:error:serverFail` (opaque last-resort)
  *
+ *   ## Beyond Core + Mail, this also ships
+ *
+ *   - **Push channel (RFC 8887)** — `eventSourceHandler` (SSE) and
+ *     `webSocketHandler` (WebSocket, with `StateChange` push).
+ *   - **Blob upload/download (RFC 8620 §6)** — `uploadHandler` /
+ *     `downloadHandler`, routing uploads through the guard-* family.
+ *   - **EmailSubmission/set (RFC 8621 §7.5)** — `emailSubmissionSetHandler`,
+ *     composing `b.mail.send.deliver`.
+ *
  *   ## What v1 does NOT ship
  *
- *   - **Push channel (SSE + WebSocket per RFC 8887)** — operator wires
- *     `b.sse` or `b.websocket` to the `pushSubscribe` hook. v1.5
- *     bundles a turnkey push handler.
- *   - **Blob upload/download endpoints** — operator wires their own
- *     `/jmap/upload` / `/jmap/download` handlers; the framework
- *     supplies `b.storage` + `b.objectStore` + the guard-* family
- *     for the actual upload path.
- *   - **EmailSubmission (RFC 8621 §7)** — operator wires the bridge
- *     to `b.mail.server.submission`'s outbound agent.
- *   - **Calendars / Contacts (RFC 9610)**, **Sieve (RFC 9404)**,
+ *   - **Calendars / Contacts (RFC 9610)**, **Sieve (RFC 9661)**,
  *     **MDN (RFC 9007)** — opt-in capabilities.
  *
  * @card

package/lib/vendor/blamejs/lib/mail-server-managesieve.js

@@ -95,7 +95,7 @@
  *
  *   - **CHECKSCRIPT** (RFC 5804 §2.12) — parse-only verb. Operators
  *     who want it compose `b.safeSieve.validate` directly via JMAP
- *     `SieveScript/validate` (RFC 9404). The MTA-side ManageSieve
+ *     `SieveScript/validate` (RFC 9661). The MTA-side ManageSieve
  *     surface is `PUTSCRIPT` + `HAVESPACE`; CHECKSCRIPT adds a third
  *     entry point with no operator demand yet.
  *   - **UNAUTHENTICATE** (RFC 5804 §2.14) — exotic. Operators close