@blamejs/blamejs-shop 0.1.37 → 0.2.0

package/lib/vendor/blamejs/lib/safe-ical.js

@@ -15,7 +15,7 @@
  *   delivery-time iTIP processing, and the scheduling primitives that
  *   compose against ical bytes.
  *
- *   Defends `CVE-2024-39687` (ical4j RRULE recursion / "Outlook
+ *   Defends the ical4j RRULE-recursion expansion-DoS class ("Outlook
  *   calendar bomb" — a hostile RRULE with unbounded COUNT and
  *   recursive BYxxx expansion can pin a CalDAV server's CPU at 100%
  *   until the request times out). Caps:
@@ -36,8 +36,8 @@
  *       instances than this cap.
  *     - RRULE BYDAY / BYMONTH / BYMONTHDAY / BYHOUR / BYMINUTE /
  *       BYSECOND / BYSETPOS / BYWEEKNO / BYYEARDAY list-length cap
- *       (24 entries) — refused regardless of profile. CVE-2024-39687
- *       achieves expansion blow-up by stacking long BYxxx lists.
+ *       (24 entries) — refused regardless of profile. The recursion
+ *       DoS achieves expansion blow-up by stacking long BYxxx lists.
  *
  *   Header-injection / control-char defense: refuses NUL, C0 control
  *   bytes (other than TAB inside QUOTED-PRINTABLE-shaped values), and
@@ -75,8 +75,8 @@
  * @card
  *   Bounded RFC 5545 iCalendar parser — caps total bytes, nesting
  *   depth, RRULE COUNT and BYxxx list-lengths; refuses NUL / C0 / DEL
- *   inside property values; allowlists property names; defends
- *   CVE-2024-39687 (ical4j RRULE recursion / Outlook calendar-bomb).
+ *   inside property values; allowlists property names; defends the
+ *   ical4j RRULE-recursion expansion-DoS class (Outlook calendar-bomb).
  */
 
 var C = require("./constants");
@@ -84,8 +84,8 @@ var { defineClass } = require("./framework-error");
 
 var SafeIcalError = defineClass("SafeIcalError", { alwaysPermanent: true });
 
-// RRULE caps are enforced regardless of profile — CVE-2024-39687 has
-// no safe permissive posture.
+// RRULE caps are enforced regardless of profile — the recursion-DoS
+// class has no safe permissive posture.
 var RRULE_MAX_COUNT      = 10000;                                                                          // allow:raw-byte-literal — RFC 5545 §3.3.10 recurrence-count cap
 var RRULE_MAX_BY_ENTRIES = 24;                                                                             // allow:raw-byte-literal — BYxxx list-length cap
 
@@ -223,7 +223,7 @@ function parse(text, opts) {
   if (byteLen > caps.maxBytes) {
     throw new SafeIcalError("safe-ical/oversize-bytes",
       "safeIcal.parse: input " + byteLen + " bytes exceeds maxBytes=" + caps.maxBytes +
-      " (CVE-2024-39687-class defense)");
+      " (calendar-bomb defense)");
   }
 
   var lines = _unfold(s, caps);
@@ -466,7 +466,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
   if (depth > ctx.caps.maxNestingDepth) {
     throw new SafeIcalError("safe-ical/oversize-nesting",
       "safeIcal.parse: nesting depth exceeds maxNestingDepth=" +
-      ctx.caps.maxNestingDepth + " (CVE-2024-39687-class defense)");
+      ctx.caps.maxNestingDepth + " (calendar-bomb defense)");
   }
   ctx.componentCount += 1;
   if (ctx.componentCount > ctx.caps.maxComponents) {
@@ -516,7 +516,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
         "safeIcal.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");
     }
-    // RRULE caps — CVE-2024-39687 defense.
+    // RRULE caps — recursion-DoS / calendar-bomb defense.
     if (pn === "RRULE" || pn === "EXRULE") {
       _validateRrule(ln.value);
     }
@@ -558,7 +558,7 @@ function _validateRrule(value) {
       if (!isFinite(n) || n < 0 || n > RRULE_MAX_COUNT) {
         throw new SafeIcalError("safe-ical/oversize-rrule-count",
           "safeIcal.parse: RRULE COUNT=" + val + " exceeds cap=" +
-          RRULE_MAX_COUNT + " (CVE-2024-39687 defense)");
+          RRULE_MAX_COUNT + " (calendar-bomb defense)");
       }
     } else if (key === "BYDAY" || key === "BYMONTH" || key === "BYMONTHDAY" ||
                key === "BYHOUR" || key === "BYMINUTE" || key === "BYSECOND" ||
@@ -567,7 +567,7 @@ function _validateRrule(value) {
       if (entries.length > RRULE_MAX_BY_ENTRIES) {
         throw new SafeIcalError("safe-ical/oversize-rrule-by",
           "safeIcal.parse: RRULE " + key + " list length " + entries.length +
-          " exceeds cap=" + RRULE_MAX_BY_ENTRIES + " (CVE-2024-39687 defense)");
+          " exceeds cap=" + RRULE_MAX_BY_ENTRIES + " (calendar-bomb defense)");
       }
     }
   }

package/lib/vendor/blamejs/lib/safe-mime.js

@@ -27,7 +27,7 @@
  *       crypto.
  *
  *   Defends `CVE-2024-39929` (Exim MIME multipart parser) and
- *   `CVE-2025-30258` (gnumail truncated-MIME-tree class) by capping
+ *   `CVE-2026-26312` (Stalwart nested `message/rfc822` MIME OOM) by capping
  *   total parts, nesting depth, boundary length, header bytes,
  *   header-line bytes, decoded body bytes, message bytes — plus
  *   charset + transfer-encoding allowlists.
@@ -41,7 +41,7 @@
  *   incoming message above a threshold.
  *
  * @card
- *   Bounded MIME parser — walks RFC 5322 + 2045 / 2046 / 2047 + EAI message structure into a part tree with hard caps on depth, part count, body size, header bytes, and charset / transfer-encoding allowlists. Defends CVE-2024-39929 + CVE-2025-30258.
+ *   Bounded MIME parser — walks RFC 5322 + 2045 / 2046 / 2047 + EAI message structure into a part tree with hard caps on depth, part count, body size, header bytes, and charset / transfer-encoding allowlists. Defends CVE-2024-39929 + CVE-2026-26312.
  */
 
 var C = require("./constants");
@@ -332,13 +332,13 @@ function _parsePart(buf, ctx, depth) {
   if (depth > ctx.maxNestingDepth) {
     throw new SafeMimeError("safe-mime/oversize-nesting",
       "safeMime.parse: nesting depth exceeded maxNestingDepth=" + ctx.maxNestingDepth +
-      " (CVE-2024-39929-class defense)");
+      " (CVE-2024-39929 class defense)");
   }
   ctx.partCount += 1;
   if (ctx.partCount > ctx.maxParts) {
     throw new SafeMimeError("safe-mime/oversize-part-count",
       "safeMime.parse: total parts exceeded maxParts=" + ctx.maxParts +
-      " (CVE-2024-39929-class defense)");
+      " (CVE-2024-39929 class defense)");
   }
 
   var sep = _findHeaderBodySep(buf);
@@ -668,7 +668,7 @@ function _decodeRfc2047Words(value) {
         raw = Buffer.from(text.replace(/_/g, " ").replace(/=([0-9A-Fa-f]{2})/g,
           function (__, hex) { return String.fromCharCode(parseInt(hex, 16)); }), "binary");      // allow:raw-byte-literal — parseInt radix 16, not bytes
       }
-      // RFC 2047 §5 / CVE-2020-7244 header-injection defense — after
+      // RFC 2047 §5 encoded-word header-injection defense — after
       // base64 / Q-encoded decode, check the DECODED bytes for header
       // separators (CR, LF, NUL). A sender that base64-encodes
       // `\r\nBcc: attacker@x.com` would otherwise reach the consumer's
@@ -680,7 +680,7 @@ function _decodeRfc2047Words(value) {
         if (b === 0x0d /* CR */ || b === 0x0a /* LF */ || b === 0x00 /* NUL */) {
           throw new SafeMimeError("safe-mime/rfc2047-header-injection",
             "RFC 2047 encoded-word decoded to bytes containing CR/LF/NUL " +
-            "(byte index " + bi + "); refusing per RFC 2047 §5 / CVE-2020-7244 class");
+            "(byte index " + bi + "); refusing per RFC 2047 §5 (encoded-word header injection)");
         }
       }
       return _decodeBufferAs(raw, charset);

package/lib/vendor/blamejs/lib/safe-sieve.js

@@ -619,7 +619,7 @@ function parse(script, opts) {
  * Parse-only validation — returns `{ ok, requiredCaps, issues }`
  * shape mirroring the rest of the guard family. Operator-facing
  * primitives that want a JMAP-style `SieveScript/validate` response
- * (RFC 9404) compose this and surface `issues` directly.
+ * (RFC 9661 — JMAP for Sieve Scripts) compose this and surface `issues` directly.
  *
  * @opts
  *   profile:           "strict" | "balanced" | "permissive",

package/lib/vendor/blamejs/lib/safe-smtp.js

@@ -23,7 +23,7 @@
  *     - RFC 5321 §2.3.8 — line termination MUST be CRLF
  *     - RFC 5321 §4.5.2 — dot-stuffing on the SMTP body
  *     - RFC 5321 §4.1.1.4 — DATA command terminates with `<CRLF>.<CRLF>`
- *     - CVE-2023-51764 / -51765 / -51766 / 2024-32178 — SMTP
+ *     - CVE-2023-51764 / -51765 / -51766 — SMTP
  *       smuggling (parsers that accept bare-LF dot-terminators).
  *       The guard primitive `b.guardSmtpCommand.detectBodySmuggling`
  *       owns smuggling detection; the safe-* terminator scanner

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.6",
+  "version": "0.13.12",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.10.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.10",
+  "date": "2026-05-27",
+  "headline": "Documented-but-inert options wired up, a non-existent CVE reference removed, and a silent iCalendar cap-bypass fixed",
+  "summary": "A sweep for places where a documented option or citation did not match what the code does. The most operator-relevant fix: b.calendar.fromIcal documented a safeIcalOpts option that forwards parser caps (byte size, RRULE limits, nesting depth) to b.safeIcal.parse, but the value was never forwarded — so an operator who set tight caps through it got the default profile instead, silently. That is corrected; the nested options now reach the parser. b.archive.read.zip documented an AbortSignal option that was never honored; it now aborts the read at the entry boundary. b.auth.fal documented a bearerOnly alias that had no effect; it now forces the no-proof-of-possession path and refuses the contradictory combination of bearerOnly:true with a holder-of-key binding. Separately, the auth verification paths cited CVE-2026-23993 (13 places) for the \"reject an unknown alg before key lookup\" guard — that CVE id does not exist (the registry has no record of it); the citation is replaced with the weakness class (CWE-347 / CWE-757) and the real, verifiable neighboring CVEs. The circuit-breaker error-code note that promised a rename \"in v0.10\" is corrected to the actual plan (v1.0), and the build gate that catches overdue version promises now also catches two-part version numbers.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.calendar.fromIcal` now forwards `safeIcalOpts` to the parser",
+          "body": "The documented `safeIcalOpts` option (parser caps: max bytes, RRULE COUNT/BYxxx limits, nesting depth) was not being passed to `b.safeIcal.parse` — when supplied under the documented nested key it was silently ignored and the parser ran with its default profile. Both forms now reach the parser: the documented nested `{ safeIcalOpts: { ... } }` and the top-level `{ profile, ... }` that earlier releases accepted, with the nested form winning on conflict. No caller regresses."
+        },
+        {
+          "title": "`b.archive.read.zip` honors the documented `signal` (AbortSignal)",
+          "body": "The `signal` option was documented but never read. A large or slow archive read can now be aborted cooperatively — the reader checks the signal at each entry boundary (`inspect`, `entries`, `extractEntries`, `extract`) and rejects with an `archive-read/aborted` error."
+        },
+        {
+          "title": "Removed a non-existent CVE reference from the JWT/JWE verification paths",
+          "body": "The \"reject an unknown/unsupported `alg` before any key lookup\" guard in `b.auth.jwt.verifyExternal`, `b.auth.oauth.verifyIdToken`, `b.auth.oid4vci`, and `b.auth.sd-jwt-vc` cited a CVE id that the registry has no record of. The behaviour is unchanged; the citation is now the weakness class it defends (CWE-347 improper signature verification / CWE-757 algorithm downgrade) alongside the real, verifiable alg-confusion / JWE-bypass CVEs already cited beside it."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "`b.auth.fal` `bearerOnly` is now a real alias and refuses contradictions",
+          "body": "`bearerOnly: true` now forces the no-proof-of-possession path (equivalent to `hokBinding: null`), as documented. Passing `bearerOnly: true` together with a non-null `hokBinding` is a contradictory assurance request and is now refused at the call rather than silently resolved one way."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Overdue-version-promise gate now catches two-part version numbers",
+          "body": "The build gate that flags a deferral whose promised landing version has already shipped previously matched only three-part versions (`vN.N.N`); a two-part promise (`vN.N`) slipped past it. It now matches both. The `b.circuitBreaker` `CIRCUIT_OPEN` error-code note that pointed at a passed version is corrected to its actual plan (rename at v1.0, with a deprecation warning a minor ahead)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.11.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.11",
+  "date": "2026-05-27",
+  "headline": "Test-suite reliability: replaced fixed-delay waits in the rate-limiter and scheduler suites with condition polling",
+  "summary": "No runtime behaviour changes. The rate-limiter, scheduler, and websocket-channel test suites waited for asynchronous work to settle by draining a fixed number of event-loop ticks before asserting. Under heavily parallel CI that budget was occasionally too short, so an assertion read state before the async work (a cluster-backend counter update, a scheduler tick-claim) had landed — an intermittent failure unrelated to the code under test. Those waits now poll the observable condition (helpers.waitUntil) and exit as soon as it holds, with a generous upper bound, so they pass quickly on fast machines and reliably under load. A build gate is added so the fixed-tick-drain shape cannot be reintroduced.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Flaky fixed-budget waits in the rate-limiter / scheduler / sandbox test suites made contention-tolerant",
+          "body": "The rate-limit-cluster and scheduler-exactly-once suites drained a fixed count of event-loop ticks before asserting on asynchronously-updated state; under contended CI the budget could expire before the work settled, producing intermittent failures. They now wait on the actual observable condition (a written response, a settled counter). The sandbox suite's success-path cases gave the worker a 5 s execution budget that cold worker-thread startup under heavily parallel Windows CI could just exceed; those are raised to the framework's 10 s ceiling. Affects test code only — no change to shipped framework behaviour. The unused tick-drain helper in the websocket-channel suite was removed."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Build gate rejects the fixed-tick-drain wait shape in tests",
+          "body": "A new test-suite lint rule flags the counted microtask/tick-drain idiom (reassigning a promise to its own `.then()` in a loop to wait a fixed number of ticks), the sibling of the existing fixed-`setTimeout`-sleep rule. A single event-loop yield is unaffected; only the drain-as-wait shape is rejected, directing the wait to condition polling instead."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.12.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.12",
+  "date": "2026-05-27",
+  "headline": "Inbound MX listener now runs the connection-level gate cascade it documented — HELO identity, DNS blocklist, and greylisting",
+  "summary": "b.mail.server.mx.create documented helo / rbl / greylist gate options, but the listener never invoked them — an operator who wired them got silent acceptance of mail those gates would have rejected. They are now wired into the live SMTP state machine: the HELO-identity gate evaluates at HELO/EHLO and refuses a spoofed or malformed identity with 550; the DNS-blocklist gate evaluates the connecting IP once per connection and refuses a listed source with 554; the greylisting gate defers a first-seen (ip, sender, recipient) tuple with a 450 tempfail so legitimate senders retry and pass. Each gate is skipped when the operator doesn't wire it. Because these gates do DNS and store lookups, the per-connection command pump was reworked to process commands asynchronously and strictly in arrival order, so pipelined commands (RFC 2920) cannot overtake a gate still resolving and the existing SMTP-smuggling and STARTTLS-stripping defenses are unchanged. The message-authentication gate (SPF/DKIM/DMARC alignment via b.guardEnvelope) needs the inbound SPF + DKIM verification results as inputs; that inbound-auth pipeline lands as a follow-up, and the documentation no longer implies that gate is active today.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "HELO-identity / RBL / greylist gates wired into `b.mail.server.mx`",
+          "body": "When wired, `opts.helo` (FCrDNS / HELO-shape / self-name checks) refuses a bad HELO identity at HELO/EHLO with 550; `opts.rbl` refuses a connecting IP found on a DNS blocklist with 554 (evaluated once per connection); `opts.greylist` defers a first-seen (ip, sender, recipient) tuple with 450 4.7.1. Their verdicts surface on the `rcpt_to` event (`rblListed`, `greylist`) and the `helo` event (`heloVerdict`), with dedicated `helo_gate_refused` / `rbl_refused` / `greylist_deferred` audit events. A gate the operator doesn't supply is skipped, never synthesized."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "MX command pump processes commands asynchronously and in arrival order",
+          "body": "Gate evaluation involves DNS and store lookups, so the per-connection command pump now awaits each command before the next. Pipelined commands are serialized so a gate resolving cannot let a later command answer ahead of an earlier one; reply ordering, the bare-LF SMTP-smuggling refusal, and the STARTTLS-stripping defense are unchanged. No change to the listener's external behaviour when no gates are wired."
+        }
+      ]
+    },
+    {
+      "heading": "Deprecated",
+      "items": [
+        {
+          "title": "SPF/DKIM/DMARC-alignment gate documentation corrected to match what is active",
+          "body": "The `envelope` (SPF/DKIM/DMARC alignment) and `dmarc` gate options were documented as wireable but require inbound SPF + DKIM verification results the listener does not yet produce. They are removed from the documented option set until the inbound-authentication pipeline (composing `b.mail.spf` + `b.mail.dmarc` + DKIM verification) lands; run those checks on the delivered message via the agent handoff in the meantime."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.7.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.7",
+  "date": "2026-05-26",
+  "headline": "Documentation accuracy — several primitives described shipped features as deferred",
+  "summary": "A documentation sweep corrected primitive descriptions that still called features deferred after they shipped, so the wiki and inline docs now match the code. b.mdoc documents that device authentication (the ISO 18013-5 §9.1.3 signature variant, verifyDeviceAuth) is verified, not deferred — only the COSE_Mac0 device-auth variant remains refused. b.network.dns.dnssec documents that the root-to-zone chain walk against the IANA trust anchors (verifyChain) and NSEC / NSEC3 denial of existence (verifyDenial / nsec3Hash) ship, where the card previously said they were deferred. b.cose lists COSE_Mac0 and COSE_Encrypt0 among what it ships. The JMAP server documents its push channel, blob upload/download, and EmailSubmission handlers as present, and the submission server documents CHUNKING / BDAT as supported. A new test detector keeps this class of drift from recurring: it fails the build when a comment promises a feature lands in a version that has already shipped.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Corrected `deferred`/`does-not-ship` docs for features that have shipped",
+          "body": "`b.mdoc` (device authentication, §9.1.3), `b.network.dns.dnssec` (chain walk + NSEC/NSEC3), `b.cose` (COSE_Mac0 + COSE_Encrypt0), the JMAP server (push, blob, EmailSubmission), and the submission server (BDAT/CHUNKING) all carried `@card`/`@intro` text describing shipped capabilities as deferred or not-shipped. The descriptions now match the implemented surface; genuinely-deferred items (the mdoc MAC variant, DNSSEC in-RDATA name canonicalization, COSE multi-signer/multi-recipient) remain documented as such."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Overdue-defer detector in the codebase-pattern gate",
+          "body": "A new check fails the build when a comment promises a feature \"lands in\" / is \"deferred to\" / is \"not supported in\" a version that the package has already reached — catching stale deferral notes (a feature that shipped but whose comment still says otherwise, or a missed deadline) before they reach a release. An allowlist records the deliberate defer-with-condition exceptions."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.8.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.8",
+  "date": "2026-05-26",
+  "headline": "In-memory archive extraction for read-only / serverless filesystems",
+  "summary": "Archive readers gain an in-memory extraction path so an uploaded archive can be opened and its contents read without writing anything to disk — the case a read-only or ephemeral serverless filesystem requires. b.archive.read.zip(...).extractEntries() and b.archive.read.tar(...).extractEntries() are async generators that yield each regular file entry as { name, bytes, size }, applying the same bomb-policy caps, b.guardArchive metadata cascade (which refuses a Zip-Slip / traversal archive wholesale), and entry-type-policy refusals as the disk extract() — only the disk realpath agreement check is omitted, since nothing is written and the caller owns where the returned bytes land. Directory and link entries carry no content and are not yielded. The guard cascade is factored into one shared path so disk and in-memory extraction refuse identically. Also a documentation fix: b.archive.gz no longer claims a b.archive.zip().toGzip() convenience exists — a ZIP is already DEFLATE-compressed per entry, so gzip-wrapping it gains nothing; gzip the uncompressed tar stream (the canonical .tar.gz) instead.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`extractEntries()` — in-memory archive extraction (ZIP + tar)",
+          "body": "`b.archive.read.zip(source).extractEntries(opts?)` and `b.archive.read.tar(source).extractEntries(opts?)` are async generators yielding `{ name, bytes, size }` per regular file entry, never touching disk — for serverless / read-only filesystems where the disk `extract({ destination })` path cannot run. Same bomb-policy, guard-archive cascade, and entry-type-policy refusals as disk extraction; the bytes are byte-identical to what `extract()` writes."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Removed the inaccurate `b.archive.zip().toGzip()` doc claim",
+          "body": "The `b.archive.gz` documentation described a `b.archive.zip().toGzip()` convenience method that does not (and should not) exist: a ZIP is already DEFLATE-compressed per entry, so gzip-wrapping it would compress already-compressed data for no benefit. `b.archive.tar().toGzip()` (the real `.tar.gz`) is unchanged."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.9.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.9",
+  "date": "2026-05-26",
+  "headline": "Corrected CVE citations in source threat annotations + a build gate that refuses malformed CVE identifiers",
+  "summary": "Several source-comment threat annotations cited CVE identifiers that were rejected by the numbering authority (never assigned to a real issue), attributed to the wrong product, or structurally malformed (a placeholder with a non-numeric sequence). The annotated defenses are unchanged — every cap, refusal, and constant-time comparison behaves exactly as before; only the reference labels were corrected, each to a verifiable CVE or to the underlying weakness class (CWE / RFC) where no single CVE fits. Notable corrections: the S/MIME SHA-1 / MD5 certificate-signature refusal now cites the SHAttered collision and RFC 8551 §2.5 instead of a rejected candidate id; decompression-output caps cite CWE-409 and CVE-2025-0725 instead of a fabricated placeholder; the iCalendar RRULE / nesting / byte caps describe the calendar-bomb recursion-DoS class instead of an unrelated SSRF advisory; and the SAML signature-wrapping (XSW) defense now cites the actively-exploited CVE-2024-45409 (ruby-saml, CVSS 10.0) and CVE-2025-25291 / -25292 that the duplicate-element refusal defeats. A new build-time detector refuses any CVE token whose sequence number is not all-numeric, so a placeholder identifier can never reach a release again.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Corrected rejected / misattributed / malformed CVE references in source threat annotations",
+          "body": "Threat-annotation comments across the mail, crypto, auth, guard, and safe modules carried CVE identifiers that were rejected by the CVE numbering authority, attributed to the wrong product, or written as non-numeric placeholders. Each was corrected to a verifiable CVE or to the weakness class (CWE / RFC) it defends. No runtime behaviour changed — the defenses these comments describe are unchanged. The S/MIME certificate check's SHA-1 / MD5 refusal message now names the SHAttered collision and RFC 8551 §2.5; the SAML XSW defense now names CVE-2024-45409 and CVE-2025-25291 / -25292."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "`malformed-cve-identifier` — refuses structurally-invalid CVE tokens at build time",
+          "body": "A CVE identifier's sequence number is always numeric (`CVE-<year>-<digits>`). The new detector refuses any CVE token whose post-year segment contains a letter — the placeholder shape that lets a fabricated reference slip past review. It cannot verify that a well-formed id is real or correctly attributed (that stays a review responsibility), but it makes the structurally-invalid class impossible to ship."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/archive-read.test.js

@@ -223,8 +223,90 @@ async function testBundleAdapterStorageRoundTrip() {
   }
 }
 
+// In-memory extraction (serverless / read-only FS): reader.extractEntries()
+// yields decompressed bytes without ever writing to disk, and those bytes are
+// byte-identical to what disk extract() produces.
+async function testExtractEntriesInMemory() {
+  var z = b.archive.zip();
+  z.addFile("readme.txt", "Hello, in-memory!\n");
+  z.addFile("data/nums.csv", "n,sq\n2,4\n");
+  z.addFile("docs/deep.bin", Buffer.from([0, 1, 2, 3, 255]));
+  var bytes = z.toBuffer();
+
+  // Spy: no fs write may happen during the in-memory path.
+  var wrote = false;
+  var origWrite = fs.writeFileSync;
+  fs.writeFileSync = function () { wrote = true; return origWrite.apply(fs, arguments); };
+  var collected = {};
+  try {
+    var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+    for await (var e of reader.extractEntries()) { collected[e.name] = e.bytes; }
+  } finally {
+    fs.writeFileSync = origWrite;
+  }
+  check("zip extractEntries: no disk write", wrote === false);
+  check("zip extractEntries: 3 file entries (dir skipped)", Object.keys(collected).length === 3);
+  check("zip extractEntries: text bytes match", collected["readme.txt"].toString("utf8") === "Hello, in-memory!\n");
+  check("zip extractEntries: binary bytes match", collected["docs/deep.bin"].equals(Buffer.from([0, 1, 2, 3, 255])));
+
+  // Byte-equality with disk extract().
+  var dest = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-archive-mem-"));
+  try {
+    await b.safeArchive.extract({ source: bytes, destination: dest, guardProfile: "balanced" });
+    var diskBin = fs.readFileSync(path.join(dest, "docs/deep.bin"));
+    check("zip extractEntries bytes == disk extract bytes", collected["docs/deep.bin"].equals(diskBin));
+  } finally {
+    fs.rmSync(dest, { recursive: true, force: true });
+  }
+
+  // tar in-memory.
+  var t = b.archive.tar();
+  t.addFile("x.txt", "world\n");
+  t.addFile("sub/y.dat", Buffer.from([9, 8, 7]));
+  var tbytes = t.toBuffer();
+  var tcollected = {};
+  var tr = b.archive.read.tar(b.archive.adapters.buffer(tbytes));
+  for await (var te of tr.extractEntries()) { tcollected[te.name] = te.bytes; }
+  check("tar extractEntries: 2 entries", Object.keys(tcollected).length === 2);
+  check("tar extractEntries: text matches", tcollected["x.txt"].toString("utf8") === "world\n");
+  check("tar extractEntries: binary matches", tcollected["sub/y.dat"].equals(Buffer.from([9, 8, 7])));
+}
+
+// opts.signal (AbortSignal) is documented on b.archive.read.zip — verify
+// it actually aborts the read at the entry boundary rather than being a
+// dead doc opt.
+async function testSignalAbort() {
+  var z = b.archive.zip();
+  z.addFile("a.txt", "one\n");
+  z.addFile("b.txt", "two\n");
+  var bytes = z.toBuffer();
+
+  var ac = new AbortController();
+  ac.abort();   // already aborted before any read
+  var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes), { signal: ac.signal });
+
+  var inspectThrew = null;
+  try { await reader.inspect(); } catch (e) { inspectThrew = e; }
+  check("zip inspect honors an aborted signal",
+        inspectThrew && (inspectThrew.code || "").indexOf("archive-read/aborted") !== -1);
+
+  var extractThrew = null;
+  try { for await (var _e of reader.extractEntries()) { void _e; } }
+  catch (e) { extractThrew = e; }
+  check("zip extractEntries honors an aborted signal",
+        extractThrew && (extractThrew.code || "").indexOf("archive-read/aborted") !== -1);
+
+  // Sanity: with no signal the same reader works.
+  var ok = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+  var n = 0;
+  for await (var e2 of ok.extractEntries()) { void e2; n += 1; }
+  check("zip extractEntries with no signal still yields entries", n === 2);
+}
+
 async function run() {
   await testRoundTripExtract();
+  await testExtractEntriesInMemory();
+  await testSignalAbort();
   testSafeArchiveErrorClass();
   await testSafeArchiveInspect();
   await testZipBombPolicy();

package/lib/vendor/blamejs/test/layer-0-primitives/auth-jwt-defenses.test.js

@@ -4,7 +4,7 @@
  *
  *   CVE-2026-22817 — alg/kty confusion (RS256→HS256, ES256↔RSA, etc.)
  *   CVE-2026-23552 — cross-realm JWT acceptance (constant-time iss)
- *   CVE-2026-23993 — unknown-alg paths skipping verify
+ *   Alg-allowlist gate (CWE-347 / CWE-757) — unknown-alg paths skipping verify
  *
  * Plus the larger AUTH-2…AUTH-36 findings closed in the same batch:
  *
@@ -137,7 +137,7 @@ async function testCrossRealmIssRefused() {
         threw && /iss-mismatch/.test(threw.code || ""));
 }
 
-// -------- CVE-2026-23993 — unknown alg refused before key lookup --------
+// -------- Alg-allowlist gate — unknown alg refused before key lookup --------
 
 async function testUnknownAlgRefusedBeforeLookup() {
   // Caller's allowlist is ES256 only; token declares HS256. Verifier
@@ -156,8 +156,8 @@ async function testUnknownAlgRefusedBeforeLookup() {
   } catch (e) { threw = e; }
   // HS256 is in REFUSED_ALGS so the operator-allowlist refusal fires
   // FIRST; but the underlying mechanic — token alg refused before key
-  // resolution — is what CVE-2026-23993 closes.
-  check("CVE-2026-23993 — token alg refused before key lookup",
+  // resolution — is what the alg-allowlist gate (CWE-347 / CWE-757) closes.
+  check("alg-allowlist gate — token alg refused before key lookup",
         threw && /alg-not-allowed|refused-alg/.test(threw.code || ""));
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/calendar.test.js

@@ -83,6 +83,36 @@ function testFromIcalRoundTrip() {
   check("toIcal preserves DTSTART",        /DTSTART:20260522T090000/.test(back));
 }
 
+function testFromIcalSafeIcalOptsForwarded() {
+  // @opts documents safeIcalOpts as forwarded to b.safeIcal.parse.
+  // Proof it actually reaches the parser: an unknown profile inside
+  // safeIcalOpts must surface safeIcal's bad-opt refusal. If the opts
+  // were dropped (or the whole outer opts passed instead), safeIcal
+  // would default to "strict" and never throw.
+  var ical =
+    "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//test//EN\r\n" +
+    "BEGIN:VEVENT\r\nUID:a@b\r\nDTSTAMP:20260521T100000Z\r\n" +
+    "DTSTART:20260522T090000\r\nDURATION:PT1H\r\nSUMMARY:x\r\n" +
+    "END:VEVENT\r\nEND:VCALENDAR\r\n";
+  var threw = null;
+  try { b.calendar.fromIcal(ical, { safeIcalOpts: { profile: "bogus" } }); }
+  catch (e) { threw = e; }
+  check("fromIcal forwards safeIcalOpts to safeIcal.parse (bad profile refused)",
+        threw && (threw.code || "").indexOf("safe-ical/bad-opt") !== -1);
+  // And a VALID nested profile parses cleanly (no accidental refusal).
+  var ev = b.calendar.fromIcal(ical, { safeIcalOpts: { profile: "balanced" } });
+  check("fromIcal honors a valid nested safeIcalOpts profile", ev && ev["@type"] === "Event");
+  // Backward-compat: the historically-working TOP-LEVEL parser-options
+  // form must keep working (no patch-release regression).
+  var threwTop = null;
+  try { b.calendar.fromIcal(ical, { profile: "bogus" }); }
+  catch (e) { threwTop = e; }
+  check("fromIcal still honors a top-level profile (no regression)",
+        threwTop && (threwTop.code || "").indexOf("safe-ical/bad-opt") !== -1);
+  var evTop = b.calendar.fromIcal(ical, { profile: "balanced" });
+  check("fromIcal parses with a valid top-level profile", evTop && evTop["@type"] === "Event");
+}
+
 function testFromIcalNoVevent() {
   var threw = null;
   try { b.calendar.fromIcal("BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//x//EN\r\nEND:VCALENDAR\r\n"); }
@@ -840,6 +870,7 @@ function run() {
   testValidateHappyPath();
   testValidateRefusalCases();
   testFromIcalRoundTrip();
+  testFromIcalSafeIcalOptsForwarded();
   testFromIcalNoVevent();
   testRrulePreserved();
   testExpandRecurrenceDaily();