@blamejs/blamejs-shop 0.1.38 → 0.2.1

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -453,12 +453,14 @@ function create(opts) {
 
     // XSW defense — refuse duplicate top-level security-critical
     // elements. SAML XML signature wrapping (XSW) attacks shuffle
-    // signed elements alongside unsigned siblings; the parser's
-    // first-match `_findChild` lookup combined with the signed-
-    // element-ID check at L479 was vulnerable to a multi-Assertion
-    // payload where the verifier signed one but the consumer read
-    // attributes from another. Reject any Response with more than
-    // one of these structural children (Audit 2026-05-11).
+    // signed elements alongside unsigned siblings; a first-match
+    // child lookup combined with a signed-element-ID check is
+    // vulnerable to a multi-Assertion payload where the verifier
+    // signs one element but the consumer reads attributes from
+    // another. This is the class behind CVE-2024-45409 (ruby-saml,
+    // CVSS 10.0, actively exploited) and CVE-2025-25291/25292
+    // (omniauth-saml / ruby-saml namespace-confusion XSW). Reject
+    // any Response with more than one of these structural children.
     var statusChildren = _findAllChildren(root, "Status", SAML_NS.protocol);
     if (statusChildren.length > 1) {
       throw new AuthError("auth-saml/duplicate-status",
@@ -1531,9 +1533,10 @@ function create(opts) {
 //     http://www.w3.org/2009/xmlenc11#rsa-oaep          (XMLEnc 1.1 §5.4.2)
 //
 // AES-CBC content encryption (xmlenc#aes128-cbc / aes256-cbc) is
-// intentionally REFUSED: CVE-2011-1473 + the broader XML-Encryption
-// padding-oracle research (Jager & Somorovsky 2011) demonstrate that
-// CBC mode under XMLEnc is exploitable without per-content MAC.
+// intentionally REFUSED: the XML-Encryption padding-oracle research
+// (Jager & Somorovsky, "How to Break XML Encryption", CCS 2011)
+// demonstrates that CBC mode under XMLEnc is exploitable without per-
+// content MAC.
 // Operators integrating with IdPs that default to CBC (older ADFS /
 // Azure AD / Okta / Keycloak / OneLogin) MUST switch the IdP's
 // content-encryption setting to AES-128-GCM or AES-256-GCM. The
@@ -1543,7 +1546,7 @@ function create(opts) {
 //
 // SHA-1 anywhere (rsa-oaep-mgf1p with SHA-1 OAEP DigestMethod,
 // xmldsig#sha1 DigestMethod) is also refused — Bleichenbacher /
-// collision risk plus CVE-2023-49141-class advisories outweigh
+// collision risk plus CVE-2023-49141 class advisories outweigh
 // "interop with stale IdPs". Operators upgrade the IdP's digest
 // algorithm to SHA-256+ rather than relax the framework defense.
 //
@@ -1606,7 +1609,7 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
     }
     if (oaepHashName === "sha1") {
       throw new AuthError("auth-saml/encrypted-weak-oaep-digest",
-        "EncryptedKey OAEP DigestMethod is SHA-1 — refused (CVE-2023-49141-class). " +
+        "EncryptedKey OAEP DigestMethod is SHA-1 — refused (CVE-2023-49141 class). " +
         "Require SHA-256+ on IdP side.");
     }
     var spKey;
@@ -1710,7 +1713,7 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
       "(supported: W3C xmlenc11#aes128-gcm, xmlenc11#aes256-gcm, " +
       "framework-experimental urn:blamejs:experimental:xmlenc:xchacha20-poly1305). " +
       "AES-CBC content encryption is refused — switch the IdP to AES-128-GCM or AES-256-GCM " +
-      "(CVE-2011-1473 padding-oracle class).");
+      "(XMLEnc CBC padding-oracle class, Jager & Somorovsky CCS 2011).");
   }
   return clearBytes.toString("utf8");
 }

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -441,15 +441,15 @@ async function verify(presentation, opts) {
       "verify: malformed JWT header: " + e.message);
   }
   var alg = headerObj.alg;
-  // CVE-2026-23993 — refuse unknown / unsupported alg BEFORE any key
-  // resolution. The shared `_assertAlgKtyMatch` helper repeats this
+  // Alg-allowlist gate (CWE-347 / CWE-757) — refuse unknown / unsupported
+  // alg BEFORE any key resolution. The shared `_assertAlgKtyMatch` helper repeats this
   // check after the issuer key is resolved; doing it here too closes
   // the gap where an issuerKeyResolver with side effects (network
   // fetch, audit emit) would run even when the alg is unsupported.
   if (typeof alg !== "string" || SUPPORTED_ALGS.indexOf(alg) === -1) {
     throw new AuthError("auth-sd-jwt-vc/unsupported-alg",
       "verify: header alg \"" + alg + "\" not in supported set " +
-      "(CVE-2026-23993 — refused before key lookup)");
+      "(alg-allowlist gate — refused before key lookup)");
   }
   // draft-ietf-oauth-sd-jwt-vc §3.1 — typ MUST be `vc+sd-jwt` (or
   // `dc+sd-jwt` for digital-credential profile). Pre-v0.9.x the absent-

package/lib/vendor/blamejs/lib/calendar.js

@@ -354,7 +354,14 @@ function validate(jsCal) {
  *   // → { "@type":"Event", uid:"a@b", updated:"2026-05-21T10:00:00Z", ... }
  */
 function fromIcal(text, opts) {
-  var ast = safeIcal.parse(text, opts || {});
+  // Forward parser options to b.safeIcal.parse. Accept BOTH the
+  // documented nested form (`{ safeIcalOpts: { profile, caps, ... } }`)
+  // AND the historically-working top-level form (`{ profile: "balanced" }`)
+  // so neither caller regresses; the nested form wins on conflict. The
+  // `safeIcalOpts` wrapper key itself is stripped before forwarding.
+  var icalOpts = Object.assign({}, opts || {}, (opts && opts.safeIcalOpts) || {});
+  delete icalOpts.safeIcalOpts;
+  var ast = safeIcal.parse(text, icalOpts);
   var events   = (ast && ast.vcalendar && ast.vcalendar.vevent)   || [];
   var todos    = (ast && ast.vcalendar && ast.vcalendar.vtodo)    || [];
   var journals = (ast && ast.vcalendar && ast.vcalendar.vjournal) || [];
@@ -515,7 +522,7 @@ function toIcal(jsCal, opts) {
  * timestamps in the operator's `[from, to]` window. Returns an array
  * of ISO 8601 UTC strings (`yyyy-mm-ddTHH:MM:SSZ`). Bounded by
  * `MAX_EXPAND_INSTANCES` (4096) + `MAX_EXPAND_SPAN_MS` (10 years) to
- * defend against CVE-2024-39687-class recurrence-bomb expansion.
+ * defend against the RRULE recurrence-bomb expansion class.
  *
  * v1 supports FREQ=DAILY/WEEKLY/MONTHLY/YEARLY with INTERVAL, COUNT,
  * UNTIL. BYDAY / BYMONTH / BYMONTHDAY / BYWEEKNO / BYYEARDAY /

package/lib/vendor/blamejs/lib/circuit-breaker.js

@@ -42,10 +42,11 @@ var retryHelper = require("./retry");
  * with the framework's `create(opts)` vocabulary.
  *
  * The `CIRCUIT_OPEN` error code is a pre-v1 artifact — every other
- * framework error class uses namespaced codes (`retry/...`). The
- * rename is deferred to v0.10 with a deprecation cycle so existing
- * operators who match `err.code === "CIRCUIT_OPEN"` aren't broken
- * in a patch.
+ * framework error class uses namespaced codes (`retry/...`). It is
+ * kept through the pre-1.0 line so existing operators who match
+ * `err.code === "CIRCUIT_OPEN"` aren't broken in a patch; the rename
+ * to a namespaced code lands at v1.0 alongside the namespaced-error
+ * sweep, with a deprecation warning shipping a minor ahead.
  *
  * @opts
  *   name:             string,    // identifier used in audit + state-change events

package/lib/vendor/blamejs/lib/crypto-hpke.js

@@ -5,7 +5,7 @@
  * Suite (PQC-first per framework crypto policy):
  *   KEM:    ML-KEM-1024 (FIPS 203) — post-quantum encapsulation
  *   KDF:    HKDF-SHA3-512
- *   AEAD:   ChaCha20-Poly1305 (RFC 7539)
+ *   AEAD:   ChaCha20-Poly1305 (RFC 8439, obsoletes RFC 7539)
  *
  * The classical HPKE suites in RFC 9180 §7 (DHKEM with X25519 / P-256 /
  * P-384 / P-521 + HKDF-SHA256/384/512 + AES-GCM/ChaCha20) are NOT

package/lib/vendor/blamejs/lib/crypto-oprf.js

@@ -30,14 +30,14 @@
  *   <code>suite(name)</code> returns the suite for one of the RFC 9497
  *   ciphersuites — <code>ristretto255-sha512</code> (the Privacy Pass
  *   default), <code>p256-sha256</code>, <code>p384-sha384</code>, or
- *   <code>p521-sha512</code> — each exposing the three modes. Group and
+ *   <code>p521-sha512</code> — each exposing both shipped modes. Group and
  *   hash-to-curve operations come from the vendored <code>@noble/curves</code>.
  *   Byte arguments are <code>Uint8Array</code> / <code>Buffer</code>;
  *   returned elements and outputs are <code>Uint8Array</code>.
  *
  * @card
  *   RFC 9497 Oblivious PRFs — learn <code>F(key, input)</code> without the
- *   server seeing the input (oprf / voprf / poprf modes; ristretto255 / P-256
+ *   server seeing the input (oprf / voprf modes; ristretto255 / P-256
  *   / P-384 / P-521 suites). The primitive behind Privacy Pass, password
  *   hardening, and private set intersection.
  */

package/lib/vendor/blamejs/lib/crypto.js

@@ -789,7 +789,7 @@ function toBase64Url(buf) {
  *
  * Strict mode (default) refuses non-canonical input — chars outside
  * the RFC 4648 §5 alphabet, length-mod-4-of-1, mixed `+/` from
- * standard base64, trailing garbage. Defends a CVE-2022-0235-class
+ * standard base64, trailing garbage. Defends a CVE-2022-0235 class
  * footgun where Node's permissive decoder silently tolerated
  * tampered JWT signatures. Operators with a documented lossy legacy
  * payload opt out per call via `{ strict: false }`.
@@ -817,7 +817,7 @@ function fromBase64Url(s, opts) {
   // OAuth `state` round-tripping) MUST reject non-canonical / malformed
   // input. The Node base64url decoder silently tolerates trailing
   // garbage, mixed `+/` from standard base64, missing padding errors,
-  // and length-mod-4 shapes — CVE-2022-0235-class footgun. Strict mode
+  // and length-mod-4 shapes — CVE-2022-0235 class footgun. Strict mode
   // (the default) refuses anything outside the RFC 4648 §5 alphabet +
   // length rules. Operators with a known-lossy legacy payload pass
   // `{ strict: false }` to opt out per call.

package/lib/vendor/blamejs/lib/framework-error.js

@@ -290,7 +290,8 @@ var GuardTimeError        = defineClass("GuardTimeError",        { alwaysPermane
 var GuardMimeError        = defineClass("GuardMimeError",        { alwaysPermanent: true });
 // GuardJwtError covers JWT identifier violations: shape malformation
 // (not 3 base64url segments), alg=none refuse (canonical CVE-class —
-// CVE-2015-9235 jsonwebtoken / CVE-2018-0114 java-jwt), alg-allowlist
+// CVE-2015-9235 jsonwebtoken alg:none / CVE-2018-0114 Cisco node-jose
+// embedded-JWK key confusion), alg-allowlist
 // drift, kid path-traversal (operator keyResolver path-injection
 // class), typ confusion, oversized header / payload / signature,
 // exp / nbf / iat sanity, missing required claims, unknown crit

package/lib/vendor/blamejs/lib/guard-filename.js

@@ -91,6 +91,20 @@ var WIN_RESERVED_NAMES = Object.freeze([
   "CLOCK$", "CONFIG$",
 ]);
 
+// Windows folds the superscript digits U+00B9 / U+00B2 / U+00B3 to
+// 1 / 2 / 3 when matching COM/LPT device names, so a superscript-digit
+// form resolves to the same device. Built from numeric codepoints so
+// the source stays pure-ASCII (guard-family rule).
+var _SUPERSCRIPT_DIGIT_MAP = (function () {
+  var m = {};
+  m[String.fromCharCode(0xB9)] = "1";
+  m[String.fromCharCode(0xB2)] = "2";
+  m[String.fromCharCode(0xB3)] = "3";
+  return m;
+})();
+var _SUPERSCRIPT_DIGIT_RE = new RegExp("[" + String.fromCharCode(0xB9, 0xB2, 0xB3) + "]", "g"); // allow:dynamic-regex — superscript-digit codepoints from a numeric table
+
+
 // Path-traversal indicators (anchored matches on raw and percent-decoded
 // forms).
 var PATH_TRAVERSAL_RE = /(^|[/\\])\.\.($|[/\\])/;
@@ -243,7 +257,16 @@ function _normalizeNFC(s) {
 function _isWinReserved(name) {
   // Reserved-name check applies to the base (without extension) AND to
   // the entire leaf — both `CON` and `CON.txt` collide with the device.
-  var upper = name.toUpperCase();
+  // Windows normalizes the superscript digits U+00B9 / U+00B2 / U+00B3
+  // to 1 / 2 / 3 when matching COM/LPT device names, so those superscript
+  // forms resolve to the same devices as COM1 / LPT3; fold them to ASCII
+  // before comparison so the spoofed forms are caught too. (Source stays
+  // pure-ASCII per the guard-family rule — the codepoints are escaped.)
+  // Fold COM/LPT superscript-digit spoofs to ASCII before matching
+  // (Windows treats them as the device). See _SUPERSCRIPT_DIGIT_* below.
+  var upper = name.toUpperCase().replace(_SUPERSCRIPT_DIGIT_RE, function (ch) {
+    return _SUPERSCRIPT_DIGIT_MAP[ch] || ch;
+  });
   for (var i = 0; i < WIN_RESERVED_NAMES.length; i += 1) {
     var r = WIN_RESERVED_NAMES[i];
     if (upper === r) return true;
@@ -952,6 +975,29 @@ var PATH_MAX_BYTES = 4096;
  * resolved absolute path on success; throws `GuardFilenameError` on
  * any refusal.
  *
+ * Per-segment Windows-extraction hazards are refused too — these are
+ * within-root write-target redirections / collisions that the
+ * containment + realpath checks structurally cannot see, so they need
+ * a name-level check the disk `validate` / `sanitize` paths already
+ * carry: a Windows reserved device name (`CON` / `NUL` / `COM1` / …,
+ * which resolves to the device), NTFS alternate-data-stream syntax
+ * (`name:stream`, which writes a hidden stream of the base file), and a
+ * trailing dot / leading-or-trailing whitespace (`secret.txt.`, which
+ * Windows strips so the entry overwrites an existing sibling). The
+ * checks are platform-unconditional — the verifier may run on Linux
+ * while extraction happens on Windows — and each has an opt-out for
+ * Linux-only targets (`reservedNamePolicy` / `adsPolicy` /
+ * `leadingTrailingPolicy: "allow"`), mirroring `validate`.
+ *
+ * Out of this primitive's scope (single-entry, name-only): 8.3 short-name
+ * aliasing (`PROGRA~1`), case-insensitive cross-entry collision
+ * (`Readme.txt` vs `README.TXT` on a case-preserving FS), and archive
+ * symlink/hardlink ENTRY-target validation. The first two are cross-entry
+ * properties and the third needs the entry's declared link target, which
+ * this function never sees — they belong to the extract orchestrator
+ * (`b.archive.read.zip.extract` / `b.safeArchive`), which owns the
+ * case-folded seen-set and the link-target gate.
+ *
  * Companion to `b.guardArchive.checkExtractionPath` (the string-only
  * portable gate the guard-archive primitive keeps fs-free for use as
  * a posture cascade member). `verifyExtractionPath` deliberately
@@ -964,8 +1010,13 @@ var PATH_MAX_BYTES = 4096;
  * Operators rolling their own extract loop call it per entry.
  *
  * @opts
- *   followSymlinks:  boolean,       // default false — symlink in the
+ *   followSymlinks:       boolean,  // default false — symlink in the
  *                                   //   resolved path refuses unless set
+ *   reservedNamePolicy:   string,   // "allow" opts out of the Windows
+ *                                   //   reserved-device-name segment check
+ *   adsPolicy:            string,   // "allow" opts out of the NTFS-ADS check
+ *   leadingTrailingPolicy: string,  // "allow" opts out of the trailing-dot /
+ *                                   //   leading-or-trailing-whitespace check
  *
  * @example
  *   var resolved = b.guardFilename.verifyExtractionPath(
@@ -1023,19 +1074,53 @@ function verifyExtractionPath(entryName, extractionRoot, opts) {
     throw new GuardFilenameError("filename.extraction-unc",
       "verifyExtractionPath: entryName starts with a UNC prefix");
   }
-  // `..` segment refuses — walk path components.
+  // `..` segment refuses — walk path components. The same walk also
+  // refuses per-segment Windows-extraction hazards the disk `validate`
+  // / `sanitize` paths already catch but that string-containment +
+  // realpath agreement cannot see, because they're WITHIN-root
+  // collisions / write-target redirections rather than boundary
+  // escapes. These checks are platform-UNCONDITIONAL: the verifier may
+  // run on Linux while the archive is extracted on Windows, so a name
+  // that's only dangerous on Windows must still be refused here.
+  // Operators on a Linux-only target opt out per check, mirroring
+  // `validate`'s policy vocabulary.
   var segs = normalized.split("/");
   for (var si = 0; si < segs.length; si += 1) {
-    if (segs[si] === ".." || segs[si] === "..\\" || segs[si] === "..%2f" || segs[si] === "..%5c") {
+    var seg = segs[si];
+    if (seg === ".." || seg === "..\\" || seg === "..%2f" || seg === "..%5c") {
       throw new GuardFilenameError("filename.extraction-traversal",
         "verifyExtractionPath: entryName contains .. segment");
     }
     // URL-encoded variants — explicit refusal so operators don't
     // need to percent-decode before passing the entry name in.
-    if (/%2e%2e/i.test(segs[si]) || /%c0%ae/i.test(segs[si])) {
+    if (/%2e%2e/i.test(seg) || /%c0%ae/i.test(seg)) {
       throw new GuardFilenameError("filename.extraction-traversal-encoded",
         "verifyExtractionPath: entryName contains encoded .. segment");
     }
+    if (seg === "" || seg === ".") continue;   // separators / current-dir — nothing to name-check
+    // Windows reserved device name (CON / NUL / COM1 / LPT1 / …): on
+    // Windows the segment resolves to the device, redirecting the write.
+    if (opts.reservedNamePolicy !== "allow" && _isWinReserved(seg)) {
+      throw new GuardFilenameError("filename.extraction-reserved-name",
+        "verifyExtractionPath: entryName segment " + JSON.stringify(seg) +
+        " collides with a Windows reserved device name");
+    }
+    // NTFS alternate data stream (name:stream): on Windows the write
+    // lands on a hidden stream of the base file, not a normal file.
+    if (opts.adsPolicy !== "allow" && /:[^:\\/]+$/.test(seg)) {
+      throw new GuardFilenameError("filename.extraction-ntfs-ads",
+        "verifyExtractionPath: entryName segment " + JSON.stringify(seg) +
+        " uses NTFS alternate-data-stream syntax (name:stream)");
+    }
+    // Trailing dot / leading-or-trailing whitespace: Windows silently
+    // strips these, so `secret.txt.` or `secret.txt ` collides with an
+    // existing sibling — an in-root overwrite the containment check
+    // cannot see.
+    if (opts.leadingTrailingPolicy !== "allow" && /^\s|\s$|\.$/.test(seg)) {
+      throw new GuardFilenameError("filename.extraction-leading-trailing",
+        "verifyExtractionPath: entryName segment " + JSON.stringify(seg) +
+        " has leading/trailing whitespace or a trailing dot (Windows strips it)");
+    }
   }
   // Resolve the destination path against the root via path.resolve
   // (string-level computation; no fs hits).

package/lib/vendor/blamejs/lib/guard-jwt.js

@@ -16,8 +16,9 @@
  *
  *   Algorithm-confusion defense: `alg=none` is universally refused
  *   at every profile (RFC 7518 §3.6 explicit-no-signature, the
- *   canonical CVE-2015-9235 jsonwebtoken / CVE-2018-0114 java-jwt
- *   class). The operator-supplied `allowedAlgs` allowlist defaults
+ *   canonical CVE-2015-9235 jsonwebtoken alg:none / CVE-2018-0114
+ *   Cisco node-jose embedded-JWK confusion class). The
+ *   operator-supplied `allowedAlgs` allowlist defaults
  *   to the framework's PQC-first set (ML-DSA-87 / ML-DSA-65 /
  *   ML-DSA-44 / SLH-DSA-SHAKE-256{f,s} / SLH-DSA-SHA2-256{f,s} /
  *   EdDSA / ES* / RS* / PS*) so HS256-against-RSA-public-key

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -493,7 +493,7 @@ function gate(opts) {
  *
  * Scan a DATA-body byte buffer for the SMTP smuggling shape per
  * CVE-2023-51764 (Postfix), CVE-2023-51765 (Sendmail), CVE-2023-51766
- * (Exim), CVE-2024-32178 (.NET System.Net.Mail). RFC 5321 §2.3.8
+ * (Exim). RFC 5321 §2.3.8
  * mandates canonical CRLF line termination; the smuggling exploit
  * relies on parsers that accept `\n.\n` (bare LF before / after the
  * dot) as an alternate body terminator and then resume parsing the
@@ -517,7 +517,7 @@ function detectBodySmuggling(buf) {
     throw new GuardSmtpCommandError("guard-smtp-command/bad-input",
       "detectBodySmuggling: input must be a Buffer");
   }
-  // The CVE-2023-51764 / 51765 / 51766 / 2024-32178 class is any
+  // The CVE-2023-51764 / 51765 / 51766 class is any
   // dot-line whose line boundary is anything OTHER than canonical
   // \r\n on BOTH sides of the dot. The canonical-and-only terminator
   // is `\r\n.\r\n`. Every other shape that some receiver might honor

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -1858,8 +1858,8 @@ function dmarcParseAggregateReport(input, opts) {
       // "stream is malformed" (operator-level diagnostic) so audit/
       // alert wiring can react differently. Node surfaces the bomb
       // case with ERR_BUFFER_TOO_LARGE / "Output length exceeded the
-      // limit" / the explicit `maxOutputLength` code. CVE-class:
-      // CVE-2024-zlib decompression amplification.
+      // limit" / the explicit `maxOutputLength` code. Defends the
+      // decompression-amplification class (CWE-409 / CVE-2025-0725).
       var msg = (e && e.message) || String(e);
       var isBomb = (e && (e.code === "ERR_BUFFER_TOO_LARGE" ||
                           e.code === "ERR_OUT_OF_RANGE")) ||

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -663,7 +663,7 @@ function _parseSignaturePacket(packetBytes) {
   if (hashAlg !== HASH_ALG_SHA256 && hashAlg !== HASH_ALG_SHA512) {
     throw new MailCryptoError("mail-crypto/pgp/bad-hash",
       "hash alg " + hashAlg + " refused; only SHA-256 (8) and SHA-512 (10) are accepted. " +
-      "SHA-1 (id=2) refused per SHAttered (CVE-2017-9006-class).");
+      "SHA-1 (id=2) refused per SHAttered (2017 SHA-1 collision).");
   }
   var hashedSubLen = body.readUInt16BE(4);
   if (6 + hashedSubLen > body.length) {

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -21,9 +21,9 @@
  *   second part as base64-encoded DER.
  *
  *   Posture (when the surface lights up):
- *     - Refuses SHA-1 as the signature hash (CVE-2017-9006-class —
- *       PKCS#7 collision attacks against legacy S/MIME) and as the
- *       certificate signature algorithm.
+ *     - Refuses SHA-1 as the signature hash (SHAttered, 2017 — practical
+ *       SHA-1 collision; RFC 8551 §2.5 mandates SHA-256+ for S/MIME) and
+ *       as the certificate signature algorithm.
  *     - Refuses RSA keys < 2048 bits (RFC 8301 §3.1 — same posture
  *       as the rest of the mail surface).
  *     - Refuses MD5 anywhere (the historical S/MIME-v2 default; long
@@ -87,8 +87,8 @@
  * CVE citations:
  *   - CVE-2017-17688 / CVE-2017-17689 (EFAIL — S/MIME variant; informs
  *     the encrypt+decrypt deferral when that surface lights up)
- *   - CVE-2017-9006 (PKCS#7 / S/MIME signature-validation bypass
- *     class — informs the SHA-1 refusal posture)
+ *   - SHAttered (2017 practical SHA-1 collision) + RFC 8551 §2.5 (SHA-256
+ *     floor for S/MIME) — inform the SHA-1 signature-hash refusal posture
  *   - CVE-2018-5407 (PortSmash — informs the side-channel hardening
  *     posture when private operations land in v2)
  */
@@ -109,7 +109,7 @@ var MailCryptoError = defineClass("MailCryptoError", { alwaysPermanent: true });
 // hand-copying strings. These reflect RFC 8551 §2.5 + RFC 8301 floors.
 var RSA_MIN_BITS = 2048;                                                          // allow:raw-byte-literal — RFC 8301 §3.1
 var ALLOWED_HASHES = ["sha256", "sha384", "sha512"];
-var REFUSED_HASHES = ["md5", "sha1"];                                             // allow:raw-byte-literal — CVE-2017-9006-class
+var REFUSED_HASHES = ["md5", "sha1"];                                             // allow:raw-byte-literal — SHAttered / RFC 8551 §2.5
 
 // PROFILES + COMPLIANCE_POSTURES — the framework's standard cross-
 // primitive contract. sign() and verify() (live since v0.10.16) read
@@ -708,7 +708,7 @@ function checkCert(opts) {
       throw new MailCryptoError("mail-crypto/smime/refused-hash",
         "cert signature algorithm '" + sigAlgName +
         "' refused — SHA-1 / MD5 in cert signatures is forbidden " +
-        "(CVE-2017-9006-class). Acceptable hashes: " + ALLOWED_HASHES.join(", "));
+        "(SHAttered SHA-1 collision; RFC 8551 §2.5). Acceptable hashes: " + ALLOWED_HASHES.join(", "));
     }
   }
 

package/lib/vendor/blamejs/lib/mail-crypto.js

@@ -62,7 +62,7 @@
  *
  * CVE citations:
  *   - CVE-2017-17688 / CVE-2017-17689 (EFAIL)
- *   - CVE-2017-9006 (PKCS#7 / S/MIME signature-validation bypass class)
+ *   - SHAttered (2017 SHA-1 collision) + RFC 8551 §2.5 — SHA-1 signature-hash refusal
  */
 
 var pgp   = require("./mail-crypto-pgp");

package/lib/vendor/blamejs/lib/mail-dav.js

@@ -112,8 +112,9 @@
  *   ## CVE defense composition
  *
  *   - `b.safeIcal` rejects RRULE COUNT > 10000 / BYxxx list > 24 →
- *     defends CVE-2024-39687 (ical4j RRULE recursion / Outlook
- *     calendar bomb) on the PUT path.
+ *     defends the ical4j RRULE-recursion / recurrence-expansion DoS
+ *     class (unbounded RRULE expansion exhausts CPU/memory) on the
+ *     PUT path.
  *   - `b.xmlC14n.parse` rejects DOCTYPE / ENTITY in the
  *     PROPFIND / REPORT body → defends XXE / billion-laughs on the
  *     query path.
@@ -125,7 +126,7 @@
  *   mount under their HTTP router. Composes b.safeIcal / b.safeVcard
  *   for PUT-body validation, b.xmlC14n.parse for PROPFIND / REPORT
  *   bodies. Per-principal URL isolation; operator-supplied storage
- *   backend. Defends CVE-2024-39687 at the PUT boundary.
+ *   backend. Defends the RRULE-recursion expansion-DoS class at the PUT boundary.
  */
 
 var lazyRequire = require("./lazy-require");
@@ -749,7 +750,7 @@ function create(opts) {
       return _refuseStatus(res, 400, "PUT requires a component path");
     }
     var bodyBuf = await _readBodyBytes(req);
-    // Validate iCal body via safeIcal — defends CVE-2024-39687 at the
+    // Validate iCal body via safeIcal — defends the RRULE-recursion expansion-DoS class at the
     // ingest boundary.
     try {
       safeIcal.parse(bodyBuf, {

package/lib/vendor/blamejs/lib/mail-deploy.js

@@ -527,8 +527,9 @@ function autoDiscoverXml(opts) {
 //     brotli or the in-progress UTA-draft requires it.
 
 // Hard caps — defensive against CVE-2025-0725 (libcurl/zlib
-// integer overflow), CVE-2024-zlib decompression amplification, and
-// the §5.2 community ceiling (receivers commonly cap at 10 MiB).
+// integer overflow) and the decompression-amplification class
+// (CWE-409), plus the §5.2 community ceiling (receivers commonly cap
+// at 10 MiB).
 var TLSRPT_MAX_COMPRESSED_BYTES   = C.BYTES.mib(4);                                                   // allow:raw-byte-literal — 4 MiB compressed cap per §5.2 community practice
 var TLSRPT_MAX_DECOMPRESSED_BYTES = C.BYTES.mib(32);                                                  // allow:raw-byte-literal — 32 MiB decompressed cap (operators override via opts)
 var TLSRPT_MAX_RATIO              = 50;                                                               // allow:raw-byte-literal — 50:1 compression ratio refusal

package/lib/vendor/blamejs/lib/mail-server-imap.js

@@ -53,7 +53,7 @@
  *     pipelined command queued before TLS is refused with
  *     `BAD Pipelined post-STARTTLS not permitted`.
  *
- *   - **Literal-injection (CVE-2018-19518 INC IMAP class)** —
+ *   - **Literal-injection / command-continuation smuggling** —
  *     `{n}` literal continuation MUST come on a line of its own
  *     (per `b.guardImapCommand.detectLiteralSmuggling`); oversize
  *     literals refused (default 64 MiB); LITERAL+ (RFC 7888) non-

package/lib/vendor/blamejs/lib/mail-server-jmap.js

@@ -106,7 +106,7 @@
  *
  *   ## What v1 does NOT ship
  *
- *   - **Calendars / Contacts (RFC 9610)**, **Sieve (RFC 9404)**,
+ *   - **Calendars / Contacts (RFC 9610)**, **Sieve (RFC 9661)**,
  *     **MDN (RFC 9007)** — opt-in capabilities.
  *
  * @card

package/lib/vendor/blamejs/lib/mail-server-managesieve.js

@@ -95,7 +95,7 @@
  *
  *   - **CHECKSCRIPT** (RFC 5804 §2.12) — parse-only verb. Operators
  *     who want it compose `b.safeSieve.validate` directly via JMAP
- *     `SieveScript/validate` (RFC 9404). The MTA-side ManageSieve
+ *     `SieveScript/validate` (RFC 9661). The MTA-side ManageSieve
  *     surface is `PUTSCRIPT` + `HAVESPACE`; CHECKSCRIPT adds a third
  *     entry point with no operator demand yet.
  *   - **UNAUTHENTICATE** (RFC 5804 §2.14) — exotic. Operators close