@blamejs/blamejs-shop 0.1.38 → 0.2.1

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -25,7 +25,7 @@
  *
  *   ## Defenses baked in
  *
- *   - **SMTP smuggling** (CVE-2023-51764 / CVE-2024-32178) — every
+ *   - **SMTP smuggling** (CVE-2023-51764 Postfix / CVE-2023-51765 Sendmail / CVE-2023-51766 Exim) — every
  *     wire line passes through `b.guardSmtpCommand.validate` which
  *     refuses bare LF, bare CR, NUL, C0 controls, DEL, and oversize.
  *     The DATA body's `\r\n.\r\n` terminator is matched on canonical
@@ -67,9 +67,11 @@
  *
  *   - `mail.server.mx.connect`           — IP, TLS state, FCrDNS hostname
  *   - `mail.server.mx.helo`              — HELO greeting, helo-gate verdict
- *   - `mail.server.mx.mail_from`         — sender, SPF verdict, alignment verdict
- *   - `mail.server.mx.rcpt_to`           — recipient, RBL verdict, greylist verdict
- *   - `mail.server.mx.data_accepted`     — message size, DKIM verdict, DMARC verdict
+ *   - `mail.server.mx.helo_gate_refused` — HELO identity refused (gate action)
+ *   - `mail.server.mx.mail_from`         — sender address
+ *   - `mail.server.mx.rcpt_to`           — recipient, rblListed flag, greylist action
+ *   - `mail.server.mx.rbl_refused`       — connecting IP on a DNS blocklist (zones)
+ *   - `mail.server.mx.greylist_deferred` — (ip, from, rcpt) first-seen 450 deferral
  *   - `mail.server.mx.data_refused`      — refusal reason + SMTP code (5xx vs 4xx)
  *   - `mail.server.mx.delivered`         — agent.handoff ack
  *   - `mail.server.mx.tls_handshake_failed` — handshake error
@@ -100,19 +102,30 @@
  *
  *   Every gate is a primitive that already exists. The MX slice is a
  *   state-machine + wire-protocol coordinator — no new crypto, no
- *   new parsing, no new RFC-layer primitives. If a gate isn't ready
- *   (e.g. operator hasn't wired `b.mail.auth.dmarc`), the listener
- *   skips that phase with an audit note rather than synthesizing a
- *   verdict.
+ *   new parsing, no new RFC-layer primitives. When the operator
+ *   doesn't wire a gate (e.g. omits `opts.greylist`), the listener
+ *   skips that phase rather than synthesizing a verdict.
+ *
+ *   Connection-level gates are wired into the live state machine:
+ *   `opts.helo` (HELO identity) evaluates at HELO/EHLO; `opts.rbl`
+ *   (connecting-IP DNS blocklist, evaluated once per connection) and
+ *   `opts.greylist` ((ip, from, rcpt) first-seen deferral) evaluate at
+ *   RCPT TO and surface their verdicts on the `rcpt_to` event. The
+ *   message-authentication gates (`b.guardEnvelope` SPF/DKIM/DMARC
+ *   alignment) require the inbound SPF + DKIM verification results as
+ *   inputs; that inbound-auth pipeline composes `b.mail.spf` +
+ *   `b.mail.dmarc` + DKIM verification and lands as a follow-up, at
+ *   which point the DATA-phase envelope/DMARC gate wires in. Until
+ *   then operators run those checks on the delivered message via the
+ *   agent handoff.
  *
  * @card
  *   Inbound SMTP / MX listener. RFC 5321 state machine with SMTP-
  *   smuggling defense baked into the wire-protocol layer (RFC 5321
- *   §2.3.8 + CVE-2023-51764 / CVE-2024-32178), open-relay refusal by
+ *   §2.3.8 + CVE-2023-51764 / 51765 / 51766), open-relay refusal by
  *   default, STARTTLS-stripping defense (CVE-2021-38371), and the
- *   framework's mail-gate cascade (HELO / RBL / greylist /
- *   guardEnvelope / DMARC / safeMime / guardEmail) running at the
- *   appropriate phase.
+ *   connection-level gate cascade (HELO identity / RBL / greylist)
+ *   running at the appropriate phase.
  */
 
 var net   = require("node:net");
@@ -149,6 +162,7 @@ var REPLY_221_BYE                = "221";
 var REPLY_250_OK                 = "250";
 var REPLY_354_START_INPUT        = "354";
 var REPLY_421_SERVICE_NOT_AVAIL  = "421";                                                             // allow:raw-byte-literal — SMTP transient code
+var REPLY_450_MAILBOX_BUSY       = "450";                                                             // allow:raw-byte-literal — SMTP transient code (greylist tempfail)
 var REPLY_451_LOCAL_ERROR        = "451";                                                             // allow:raw-byte-literal — SMTP transient code
 var REPLY_452_INSUFFICIENT_STG   = "452";                                                             // allow:raw-byte-literal — SMTP transient code
 var REPLY_500_SYNTAX             = "500";                                                             // allow:raw-byte-literal — SMTP permanent code
@@ -177,11 +191,9 @@ var RE_SIZE      = /SIZE=(\d+)/i;
  * @opts
  *   tlsContext:        TlsContext,      // required — b.network.tls.context() output (no implicit plaintext)
  *   greeting:          string,          // default "blamejs ESMTP" — HELO/EHLO 220-line banner
- *   helo:              b.mail.helo,     // optional gate
- *   rbl:               b.mail.rbl,      // optional gate
- *   greylist:          b.mail.greylist, // optional gate
- *   envelope:          b.guardEnvelope, // optional gate (SPF/DKIM alignment)
- *   dmarc:             b.mail.auth.dmarc,  // optional gate
+ *   helo:              b.mail.helo,            // optional gate — HELO identity (FCrDNS / shape / self-name)
+ *   rbl:               b.mail.rbl.create(…),   // optional gate — DNS blocklist on the connecting IP
+ *   greylist:          b.mail.greylist.create(…), // optional gate — defer first-seen (ip, from, rcpt)
  *   agent:             b.mail.agent,    // optional delivery handoff
  *   relayAllowedFor:   [{ cidr, scope }],  // operator-explicit relay allowlist; default [] = MX-only
  *   localDomains:      [string],        // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1)
@@ -199,7 +211,6 @@ var RE_SIZE      = /SIZE=(\d+)/i;
  *     helo:         b.mail.helo,
  *     rbl:          b.mail.rbl.create({ providers: ["zen.spamhaus.org"] }),
  *     greylist:     b.mail.greylist.create({ store: greylistStore }),
- *     envelope:     b.guardEnvelope,
  *     agent:        b.mail.agent.create({ store: mailStore }),
  *     localDomains: ["example.com"],
  *   });
@@ -260,8 +271,8 @@ function create(opts) {
 
   // Default-on operator-supplied-domain hardening. opts.localDomains
   // and the HELO / MAIL FROM / RCPT TO domain validations all route
-  // through `b.guardDomain` for IDN homograph defense (CVE-2017-5469
-  // class), special-use-domain refusal (RFC 6761), label-length cap
+  // through `b.guardDomain` for IDN homograph / Punycode-spoof defense
+  // (mixed-script confusable class), special-use-domain refusal (RFC 6761), label-length cap
   // (RFC 1035 §2.3.4), and bare-IP-as-domain refusal (CVE-2021-22931
   // class). Operators with a closed-network deployment can pass
   // `guardDomain: false` to skip; the default keeps the protection on.
@@ -367,6 +378,15 @@ function create(opts) {
     var lineBuffer = Buffer.alloc(0);
     var bodyCollector = null;
     var inDataBody = false;
+    // Async command pump: gates (HELO / RBL / greylist / envelope /
+    // DMARC) may await DNS or a store, so command handling is async.
+    // `pumpChain` FIFO-serializes per-chunk processing so a gate
+    // resolving cannot let a later pipelined command (RFC 2920) jump
+    // ahead of an earlier one — reply ordering + the per-command
+    // smuggling defenses stay intact. `connClosed` short-circuits any
+    // chunk queued before a teardown.
+    var pumpChain = Promise.resolve();
+    var connClosed = false;
 
     socket.setTimeout(idleTimeoutMs);
     socket.on("timeout", function () {
@@ -382,6 +402,7 @@ function create(opts) {
     });
 
     socket.on("close", function () {
+      connClosed = true;
       connections.delete(socket);
     });
 
@@ -395,20 +416,35 @@ function create(opts) {
     // 220 banner — RFC 5321 §3.1.
     _writeReply(socket, REPLY_220_READY, greeting + " ready");
 
-    socket.on("data", function (chunk) {
-      try { _ingestBytes(state, socket, chunk); }
-      catch (err) {
+    // Feed a chunk into the per-connection command pump. Chains each
+    // chunk behind the previous one's full (async) processing so command
+    // handlers + their gates run strictly in arrival order. Used by BOTH
+    // the plaintext `socket.on("data")` path AND the post-STARTTLS
+    // TLSSocket onData path — otherwise gate awaits on the upgraded
+    // socket would overlap later TLS chunks (the default strict/balanced
+    // profiles require STARTTLS before MAIL, so the gates run there) and
+    // async gate rejections would go unhandled instead of producing the
+    // 421 path. `activeSock` is whichever socket is current (plaintext or
+    // TLS) so the 421/close lands on the right transport.
+    function _feedChunk(activeSock, chunk) {
+      pumpChain = pumpChain.then(function () {
+        if (connClosed) return undefined;
+        return _ingestBytes(state, activeSock, chunk);
+      }).catch(function (err) {
+        if (connClosed) return;
         _emit("mail.server.mx.handler_threw",
           { connectionId: state.id, error: (err && err.message) || String(err) },
           "failure");
-        try { _writeReply(socket, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server error"); }
+        try { _writeReply(activeSock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server error"); }
         catch (_e) { /* socket already gone */ }
-        _closeConnection(socket);
-      }
-    });
+        _closeConnection(activeSock);
+      });
+    }
+
+    socket.on("data", function (chunk) { _feedChunk(socket, chunk); });
 
     // ---- Byte-level ingestion --------------------------------------------
-    function _ingestBytes(state, socket, chunk) {
+    async function _ingestBytes(state, socket, chunk) {
       if (inDataBody) {
         // DATA body — accumulate via boundedChunkCollector, watch for
         // canonical "\r\n.\r\n" terminator only. Bare-LF dot terminator
@@ -444,9 +480,9 @@ function create(opts) {
         var endIdx = safeSmtp.findDotTerminator(collected);
         if (endIdx !== -1) {
           var body = collected.subarray(0, endIdx);
-          _finalizeDataBody(state, socket, body);
           inDataBody = false;
           bodyCollector = null;
+          await _finalizeDataBody(state, socket, body);
         }
         return;
       }
@@ -464,12 +500,13 @@ function create(opts) {
       while ((crlf = lineBuffer.indexOf(crlfNeedle)) !== -1) {
         var line = lineBuffer.subarray(0, crlf).toString("utf8");
         lineBuffer = lineBuffer.subarray(crlf + 2);
-        _handleCommand(state, socket, line);
+        await _handleCommand(state, socket, line);
         if (inDataBody) return;
+        if (connClosed) return;
       }
     }
 
-    function _handleCommand(state, socket, line) {
+    async function _handleCommand(state, socket, line) {
       // Per-line guard — refuse bare LF / NUL / C0 / DEL / oversize
       // BEFORE state-machine dispatch.
       try {
@@ -494,16 +531,16 @@ function create(opts) {
       switch (verb) {
         case "EHLO":
         case "HELO":
-          _handleEhlo(state, socket, line, verb);
+          await _handleEhlo(state, socket, line, verb);
           return;
         case "STARTTLS":
           _handleStartTls(state, socket);
           return;
         case "MAIL":
-          _handleMailFrom(state, socket, line);
+          await _handleMailFrom(state, socket, line);
           return;
         case "RCPT":
-          _handleRcptTo(state, socket, line);
+          await _handleRcptTo(state, socket, line);
           return;
         case "DATA":
           _handleData(state, socket);
@@ -531,7 +568,7 @@ function create(opts) {
     }
 
     // ---- EHLO / HELO ------------------------------------------------------
-    function _handleEhlo(state, socket, line, verb) {
+    async function _handleEhlo(state, socket, line, verb) {
       var helo = line.slice(verb.length).trim();
       if (!helo) {
         _writeReply(socket, REPLY_501_BAD_ARGS, "5.5.4 " + verb + " requires a domain argument");
@@ -552,6 +589,25 @@ function create(opts) {
           return;
         }
       }
+      // Operator HELO-identity gate (b.mail.helo) — FCrDNS / HELO-shape /
+      // self-name spoofing checks. Composed when the operator wires
+      // `opts.helo`; skipped silently otherwise (no synthesized verdict).
+      // Hard-reject actions (reject-shape / match-self-refused /
+      // literal-mismatch) refuse the connection; "accept" and the
+      // advisory "soft-*" actions pass (the soft verdict rides the event).
+      if (opts.helo && typeof opts.helo.evaluate === "function") {
+        var heloGate = await opts.helo.evaluate(
+          { claimedName: helo, ip: state.remoteAddress, tls: state.tls }, {});
+        state.heloVerdict = heloGate && heloGate.action;
+        if (heloGate && heloGate.action && heloGate.action !== "accept" &&
+            heloGate.action.indexOf("soft") !== 0) {
+          _emit("mail.server.mx.helo_gate_refused",
+            { connectionId: state.id, helo: helo, action: heloGate.action }, "denied");
+          _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL,
+            "5.7.1 " + verb + " identity refused (" + heloGate.action + ")");
+          return;
+        }
+      }
       state.helo  = helo;
       state.stage = "ehlo";
       // Multi-line 250 capabilities advertisement per RFC 5321 §4.1.1.1.
@@ -572,7 +628,8 @@ function create(opts) {
         _writeReply(socket, REPLY_250_OK, greeting + " greets " + helo);
       }
       _emit("mail.server.mx.helo",
-        { connectionId: state.id, verb: verb, helo: helo, tls: state.tls });
+        { connectionId: state.id, verb: verb, helo: helo, tls: state.tls,
+          heloVerdict: state.heloVerdict || null });
     }
 
     // ---- STARTTLS ---------------------------------------------------------
@@ -604,13 +661,11 @@ function create(opts) {
           state.helo  = null;
         },
         onData: function (tlsSocket, chunk) {
-          try { _ingestBytes(state, tlsSocket, chunk); }
-          catch (err) {
-            _emit("mail.server.mx.handler_threw",
-              { connectionId: state.id, error: (err && err.message) || String(err) },
-              "failure");
-            _closeConnection(tlsSocket);
-          }
+          // Route the upgraded socket through the SAME serialized pump as
+          // the plaintext path — post-STARTTLS is where the gates run in
+          // the default strict/balanced profiles, so it MUST be serialized
+          // and its async rejections MUST hit the 421 path.
+          _feedChunk(tlsSocket, chunk);
         },
         onError: function (err) {
           _emit("mail.server.mx.tls_handshake_failed",
@@ -626,7 +681,7 @@ function create(opts) {
     }
 
     // ---- MAIL FROM --------------------------------------------------------
-    function _handleMailFrom(state, socket, line) {
+    async function _handleMailFrom(state, socket, line) {
       if (!state.tls && _requiresStartTls()) {
         _writeReply(socket, REPLY_530_AUTH_REQUIRED, "5.7.0 Must issue a STARTTLS command first");
         return;
@@ -677,7 +732,7 @@ function create(opts) {
     }
 
     // ---- RCPT TO ----------------------------------------------------------
-    function _handleRcptTo(state, socket, line) {
+    async function _handleRcptTo(state, socket, line) {
       if (state.stage !== "rcpt") {
         _writeReply(socket, REPLY_503_BAD_SEQUENCE, "5.5.1 MAIL FROM first");
         return;
@@ -740,9 +795,49 @@ function create(opts) {
           return;
         }
       }
+      // RBL gate (b.mail.rbl) — DNS blocklist check on the connecting
+      // IP. The verdict is per-connection, so it's evaluated once and
+      // cached on state; a listed IP refuses with 554. Skipped silently
+      // when opts.rbl isn't wired.
+      if (opts.rbl && typeof opts.rbl.query === "function") {
+        if (state.rblVerdict === undefined) {
+          state.rblVerdict = await opts.rbl.query(state.remoteAddress);
+        }
+        if (state.rblVerdict && Array.isArray(state.rblVerdict.listed) &&
+            state.rblVerdict.listed.length > 0) {
+          _trackRefusedRcpt(state, rcpt, "rbl-listed");
+          _emit("mail.server.mx.rbl_refused",
+            { connectionId: state.id, remoteAddress: state.remoteAddress,
+              zones: state.rblVerdict.listed.map(function (l) { return l.zone; }) }, "denied");
+          _writeReply(socket, REPLY_554_TRANSACTION_FAILED,
+            "5.7.1 Connecting IP is on a DNS blocklist");
+          return;
+        }
+      }
+      // Greylist gate (b.mail.greylist) — defer first sight of an
+      // (ip, mailFrom, rcpt) tuple with a 450 tempfail; legitimate
+      // senders retry and pass. "defer" → 450; "accept" → continue.
+      // Skipped silently when opts.greylist isn't wired.
+      var greyVerdict = null;
+      if (opts.greylist && typeof opts.greylist.check === "function") {
+        greyVerdict = await opts.greylist.check(
+          { ip: state.remoteAddress, mailFrom: state.mailFrom || "", rcptTo: rcpt });
+        if (greyVerdict && greyVerdict.action === "defer") {
+          _emit("mail.server.mx.greylist_deferred",
+            { connectionId: state.id, remoteAddress: state.remoteAddress,
+              mailFrom: state.mailFrom, rcptTo: rcpt,
+              reason: greyVerdict.reason }, "denied");
+          _writeReply(socket, REPLY_450_MAILBOX_BUSY,
+            "4.7.1 Greylisted — please retry shortly");
+          return;
+        }
+      }
       state.rcpts.push(rcpt);
       _emit("mail.server.mx.rcpt_to",
-        { connectionId: state.id, rcptTo: rcpt, rcptCount: state.rcpts.length });
+        { connectionId: state.id, rcptTo: rcpt, rcptCount: state.rcpts.length,
+          rblListed: !!(state.rblVerdict && Array.isArray(state.rblVerdict.listed) &&
+            state.rblVerdict.listed.length > 0),
+          greylist: greyVerdict ? greyVerdict.action : null });
       _writeReply(socket, REPLY_250_OK, "2.1.5 Recipient OK");
     }
 
@@ -764,7 +859,7 @@ function create(opts) {
       });
     }
 
-    function _finalizeDataBody(state, socket, body) {
+    async function _finalizeDataBody(state, socket, body) {
       // body is the raw bytes BEFORE dot-stuffing reversal. RFC 5321
       // §4.5.2 — a single leading "." is doubled on the wire; undo.
       var dedotted = safeSmtp.dotUnstuff(body);

package/lib/vendor/blamejs/lib/mail-server-submission.js

@@ -40,7 +40,7 @@
  *
  *   ## Wire-protocol defenses (inherited from MX listener pattern)
  *
- *   - SMTP smuggling (CVE-2023-51764 / -51765 / -51766 / 2024-32178 /
+ *   - SMTP smuggling (CVE-2023-51764 / -51765 / -51766 /
  *     RFC 5321 §2.3.8): every wire line through
  *     `b.guardSmtpCommand.validate`; DATA-body terminator scan
  *     through `b.safeSmtp.findDotTerminator` (strict-CRLF);
@@ -351,8 +351,8 @@ function create(opts) {
   }
 
   // Default-on guardDomain hardening for HELO / MAIL FROM / RCPT TO.
-  // Same posture as mail-server-mx — IDN homograph (CVE-2017-5469
-  // class), special-use-domain refusal (RFC 6761), label-length cap
+  // Same posture as mail-server-mx — IDN homograph / Punycode-spoof
+  // (mixed-script confusable class), special-use-domain refusal (RFC 6761), label-length cap
   // (RFC 1035 §2.3.4), bare-IP-as-domain refusal (CVE-2021-22931
   // class). Operators with a closed-network deployment pass
   // `guardDomain: false` to skip; the default keeps protection on.

package/lib/vendor/blamejs/lib/mail-store.js

@@ -50,7 +50,7 @@
  *   of caller; only `b.legalHold.release` can flip the flag.
  *
  *   Parses messages on append via `b.safeMime.parse` (bounded
- *   substrate, defends CVE-2024-39929 + CVE-2025-30258). Validates
+ *   substrate, defends CVE-2024-39929 + CVE-2026-26312). Validates
  *   `Message-Id` via `b.guardMessageId.validate`.
  *
  * @card
@@ -526,7 +526,7 @@ function _appendMessage(args) {
       "appendMessage: folder '" + args.folderName + "' not found");
   }
 
-  // Parse via safe-mime — bounded; defends CVE-2024-39929 + CVE-2025-30258.
+  // Parse via safe-mime — bounded; defends CVE-2024-39929 + CVE-2026-26312.
   var tree = safeMime.parse(buf, args.safeMimeOpts);
 
   // Extract canonical fields.

package/lib/vendor/blamejs/lib/mail.js

@@ -1594,10 +1594,10 @@ function create(opts) {
   var auditOn = opts.audit !== false;
 
   // Default-on guardDomain hardening for every outbound recipient + the
-  // sender address. Refuses CVE-2017-5469-class IDN homograph spoofs in
+  // sender address. Refuses IDN homograph / mixed-script-confusable spoofs in
   // recipient or from domains, RFC 6761 special-use domain names
   // (`.localhost`, `.test`, `.invalid`, `.example`) in production sends,
-  // RFC 1035 §2.3.4 label-length violations, and CVE-2021-22931-class
+  // RFC 1035 §2.3.4 label-length violations, and CVE-2021-22931 class
   // bare-IP-as-domain (DNS-rebinding allowlist-bypass class). Operators
   // sending to address literals (`<x@[1.2.3.4]>`) — rare; mostly mailing-
   // list internals — pass `guardDomain: false` to opt out, or pass

package/lib/vendor/blamejs/lib/network-tls.js

@@ -462,12 +462,15 @@ function applyToContext(opts) {
 //   setKeyShares(["X25519MLKEM768", "X25519"])        → string[] (after)
 //   resetKeyShares()                                  → restores default
 
-// RFC 9794 (PQ TLS Hybrid Key Exchange) named-group ordering. The
-// preferred groups (the first the peer mutually supports wins) put the
-// IANA-registered hybrid named groups ahead of the classical fallback:
+// PQ/T-hybrid named-group ordering (RFC 9794 is the PQ/T-hybrid
+// *terminology*; the TLS codepoints come from the IANA TLS Supported
+// Groups registry + draft-kwiatkowski-tls-ecdhe-mlkem +
+// draft-ietf-tls-hybrid-design). The preferred groups (the first the peer
+// mutually supports wins) put the IANA-registered hybrid named groups
+// ahead of the classical fallback:
 //
-//   X25519MLKEM768       — codepoint 0x11EC, RFC 9794 default hybrid
-//   SecP256r1MLKEM768    — codepoint 0x11EB, RFC 9794 optional hybrid
+//   X25519MLKEM768       — codepoint 0x11EC (IANA; draft-kwiatkowski-tls-ecdhe-mlkem)
+//   SecP256r1MLKEM768    — codepoint 0x11EB (IANA; NIST-curve hybrid)
 //                            (NIST-curve fallback for FIPS-mandated peers
 //                            that refuse X25519)
 //   SecP384r1MLKEM1024   — draft-kwiatkowski-tls-ecdhe-mlkem-02 codepoint
@@ -520,7 +523,7 @@ function resetKeyShares() {
   return getKeyShares();
 }
 
-// preferredGroups — RFC 9794 alias surface for the named-group list.
+// preferredGroups — alias surface for the named-group list.
 // `set(list)` overrides the default ordering; `get()` reads the active
 // list; `reset()` restores the framework default. The setKeyShares /
 // getKeyShares / resetKeyShares names are kept as the lower-level
@@ -604,7 +607,7 @@ function buildOptions(opts) {
 
   // PQC group preference. Caller may narrow (drop a group) but not
   // widen — every requested group must appear in the framework
-  // preferred list. Both `groups` (RFC 9794 alias) and `ecdhCurve`
+  // preferred list. Both `groups` (alias) and `ecdhCurve`
   // (Node TLS option) are accepted; `groups` wins when both supplied.
   var requested = null;
   if (Array.isArray(opts.groups)) {

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -54,10 +54,12 @@
  *   bytes ever cross the audit boundary on the bomb-class path.
  *
  *   Threat model:
- *     - **CVE-2025-0725** (libcurl + zlib decompression amplification)
- *       — bounded output + ratio cap defeat the amplification.
- *     - **CVE-2024-zlib** class (decompression-bomb research, gzip /
- *       deflate / brotli variants) — bounded output prevents OOM.
+ *     - **Decompression bomb** (CWE-409 — improper handling of highly
+ *       compressed data; the classic 42.zip nested-bomb expands to
+ *       petabytes from kilobytes) across gzip / deflate / brotli —
+ *       the bounded-output cap + expansion-ratio cap refuse before the
+ *       allocation, so no decompressed bytes are ever materialized past
+ *       the cap.
  *     - **Efail-class** (CVE-2017-17688 / 17689) — operators decrypting
  *       MIME parts compose `b.safeDecompress` on the inner deflate
  *       streams; the bounded-output posture defeats the unbounded-
@@ -73,8 +75,8 @@
  *   - [RFC 1951](https://www.rfc-editor.org/rfc/rfc1951) deflate
  *   - [RFC 1952](https://www.rfc-editor.org/rfc/rfc1952) gzip
  *   - [RFC 7932](https://www.rfc-editor.org/rfc/rfc7932) brotli
- *   - [CVE-2025-0725](https://nvd.nist.gov/vuln/detail/CVE-2025-0725)
- *   - [CVE-2024-zlib](https://nvd.nist.gov/) decompression-bomb class
+ *   - [CWE-409](https://cwe.mitre.org/data/definitions/409.html) improper
+ *     handling of highly compressed data (decompression bomb)
  */
 
 var zlib = require("node:zlib");

package/lib/vendor/blamejs/lib/safe-ical.js

@@ -15,7 +15,7 @@
  *   delivery-time iTIP processing, and the scheduling primitives that
  *   compose against ical bytes.
  *
- *   Defends `CVE-2024-39687` (ical4j RRULE recursion / "Outlook
+ *   Defends the ical4j RRULE-recursion expansion-DoS class ("Outlook
  *   calendar bomb" — a hostile RRULE with unbounded COUNT and
  *   recursive BYxxx expansion can pin a CalDAV server's CPU at 100%
  *   until the request times out). Caps:
@@ -36,8 +36,8 @@
  *       instances than this cap.
  *     - RRULE BYDAY / BYMONTH / BYMONTHDAY / BYHOUR / BYMINUTE /
  *       BYSECOND / BYSETPOS / BYWEEKNO / BYYEARDAY list-length cap
- *       (24 entries) — refused regardless of profile. CVE-2024-39687
- *       achieves expansion blow-up by stacking long BYxxx lists.
+ *       (24 entries) — refused regardless of profile. The recursion
+ *       DoS achieves expansion blow-up by stacking long BYxxx lists.
  *
  *   Header-injection / control-char defense: refuses NUL, C0 control
  *   bytes (other than TAB inside QUOTED-PRINTABLE-shaped values), and
@@ -75,8 +75,8 @@
  * @card
  *   Bounded RFC 5545 iCalendar parser — caps total bytes, nesting
  *   depth, RRULE COUNT and BYxxx list-lengths; refuses NUL / C0 / DEL
- *   inside property values; allowlists property names; defends
- *   CVE-2024-39687 (ical4j RRULE recursion / Outlook calendar-bomb).
+ *   inside property values; allowlists property names; defends the
+ *   ical4j RRULE-recursion expansion-DoS class (Outlook calendar-bomb).
  */
 
 var C = require("./constants");
@@ -84,8 +84,8 @@ var { defineClass } = require("./framework-error");
 
 var SafeIcalError = defineClass("SafeIcalError", { alwaysPermanent: true });
 
-// RRULE caps are enforced regardless of profile — CVE-2024-39687 has
-// no safe permissive posture.
+// RRULE caps are enforced regardless of profile — the recursion-DoS
+// class has no safe permissive posture.
 var RRULE_MAX_COUNT      = 10000;                                                                          // allow:raw-byte-literal — RFC 5545 §3.3.10 recurrence-count cap
 var RRULE_MAX_BY_ENTRIES = 24;                                                                             // allow:raw-byte-literal — BYxxx list-length cap
 
@@ -223,7 +223,7 @@ function parse(text, opts) {
   if (byteLen > caps.maxBytes) {
     throw new SafeIcalError("safe-ical/oversize-bytes",
       "safeIcal.parse: input " + byteLen + " bytes exceeds maxBytes=" + caps.maxBytes +
-      " (CVE-2024-39687-class defense)");
+      " (calendar-bomb defense)");
   }
 
   var lines = _unfold(s, caps);
@@ -466,7 +466,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
   if (depth > ctx.caps.maxNestingDepth) {
     throw new SafeIcalError("safe-ical/oversize-nesting",
       "safeIcal.parse: nesting depth exceeds maxNestingDepth=" +
-      ctx.caps.maxNestingDepth + " (CVE-2024-39687-class defense)");
+      ctx.caps.maxNestingDepth + " (calendar-bomb defense)");
   }
   ctx.componentCount += 1;
   if (ctx.componentCount > ctx.caps.maxComponents) {
@@ -516,7 +516,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
         "safeIcal.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");
     }
-    // RRULE caps — CVE-2024-39687 defense.
+    // RRULE caps — recursion-DoS / calendar-bomb defense.
     if (pn === "RRULE" || pn === "EXRULE") {
       _validateRrule(ln.value);
     }
@@ -558,7 +558,7 @@ function _validateRrule(value) {
       if (!isFinite(n) || n < 0 || n > RRULE_MAX_COUNT) {
         throw new SafeIcalError("safe-ical/oversize-rrule-count",
           "safeIcal.parse: RRULE COUNT=" + val + " exceeds cap=" +
-          RRULE_MAX_COUNT + " (CVE-2024-39687 defense)");
+          RRULE_MAX_COUNT + " (calendar-bomb defense)");
       }
     } else if (key === "BYDAY" || key === "BYMONTH" || key === "BYMONTHDAY" ||
                key === "BYHOUR" || key === "BYMINUTE" || key === "BYSECOND" ||
@@ -567,7 +567,7 @@ function _validateRrule(value) {
       if (entries.length > RRULE_MAX_BY_ENTRIES) {
         throw new SafeIcalError("safe-ical/oversize-rrule-by",
           "safeIcal.parse: RRULE " + key + " list length " + entries.length +
-          " exceeds cap=" + RRULE_MAX_BY_ENTRIES + " (CVE-2024-39687 defense)");
+          " exceeds cap=" + RRULE_MAX_BY_ENTRIES + " (calendar-bomb defense)");
       }
     }
   }

package/lib/vendor/blamejs/lib/safe-mime.js

@@ -27,7 +27,7 @@
  *       crypto.
  *
  *   Defends `CVE-2024-39929` (Exim MIME multipart parser) and
- *   `CVE-2025-30258` (gnumail truncated-MIME-tree class) by capping
+ *   `CVE-2026-26312` (Stalwart nested `message/rfc822` MIME OOM) by capping
  *   total parts, nesting depth, boundary length, header bytes,
  *   header-line bytes, decoded body bytes, message bytes — plus
  *   charset + transfer-encoding allowlists.
@@ -41,7 +41,7 @@
  *   incoming message above a threshold.
  *
  * @card
- *   Bounded MIME parser — walks RFC 5322 + 2045 / 2046 / 2047 + EAI message structure into a part tree with hard caps on depth, part count, body size, header bytes, and charset / transfer-encoding allowlists. Defends CVE-2024-39929 + CVE-2025-30258.
+ *   Bounded MIME parser — walks RFC 5322 + 2045 / 2046 / 2047 + EAI message structure into a part tree with hard caps on depth, part count, body size, header bytes, and charset / transfer-encoding allowlists. Defends CVE-2024-39929 + CVE-2026-26312.
  */
 
 var C = require("./constants");
@@ -332,13 +332,13 @@ function _parsePart(buf, ctx, depth) {
   if (depth > ctx.maxNestingDepth) {
     throw new SafeMimeError("safe-mime/oversize-nesting",
       "safeMime.parse: nesting depth exceeded maxNestingDepth=" + ctx.maxNestingDepth +
-      " (CVE-2024-39929-class defense)");
+      " (CVE-2024-39929 class defense)");
   }
   ctx.partCount += 1;
   if (ctx.partCount > ctx.maxParts) {
     throw new SafeMimeError("safe-mime/oversize-part-count",
       "safeMime.parse: total parts exceeded maxParts=" + ctx.maxParts +
-      " (CVE-2024-39929-class defense)");
+      " (CVE-2024-39929 class defense)");
   }
 
   var sep = _findHeaderBodySep(buf);
@@ -668,7 +668,7 @@ function _decodeRfc2047Words(value) {
         raw = Buffer.from(text.replace(/_/g, " ").replace(/=([0-9A-Fa-f]{2})/g,
           function (__, hex) { return String.fromCharCode(parseInt(hex, 16)); }), "binary");      // allow:raw-byte-literal — parseInt radix 16, not bytes
       }
-      // RFC 2047 §5 / CVE-2020-7244 header-injection defense — after
+      // RFC 2047 §5 encoded-word header-injection defense — after
       // base64 / Q-encoded decode, check the DECODED bytes for header
       // separators (CR, LF, NUL). A sender that base64-encodes
       // `\r\nBcc: attacker@x.com` would otherwise reach the consumer's
@@ -680,7 +680,7 @@ function _decodeRfc2047Words(value) {
         if (b === 0x0d /* CR */ || b === 0x0a /* LF */ || b === 0x00 /* NUL */) {
           throw new SafeMimeError("safe-mime/rfc2047-header-injection",
             "RFC 2047 encoded-word decoded to bytes containing CR/LF/NUL " +
-            "(byte index " + bi + "); refusing per RFC 2047 §5 / CVE-2020-7244 class");
+            "(byte index " + bi + "); refusing per RFC 2047 §5 (encoded-word header injection)");
         }
       }
       return _decodeBufferAs(raw, charset);

package/lib/vendor/blamejs/lib/safe-sieve.js

@@ -619,7 +619,7 @@ function parse(script, opts) {
  * Parse-only validation — returns `{ ok, requiredCaps, issues }`
  * shape mirroring the rest of the guard family. Operator-facing
  * primitives that want a JMAP-style `SieveScript/validate` response
- * (RFC 9404) compose this and surface `issues` directly.
+ * (RFC 9661 — JMAP for Sieve Scripts) compose this and surface `issues` directly.
  *
  * @opts
  *   profile:           "strict" | "balanced" | "permissive",

package/lib/vendor/blamejs/lib/safe-smtp.js

@@ -23,7 +23,7 @@
  *     - RFC 5321 §2.3.8 — line termination MUST be CRLF
  *     - RFC 5321 §4.5.2 — dot-stuffing on the SMTP body
  *     - RFC 5321 §4.1.1.4 — DATA command terminates with `<CRLF>.<CRLF>`
- *     - CVE-2023-51764 / -51765 / -51766 / 2024-32178 — SMTP
+ *     - CVE-2023-51764 / -51765 / -51766 — SMTP
  *       smuggling (parsers that accept bare-LF dot-terminators).
  *       The guard primitive `b.guardSmtpCommand.detectBodySmuggling`
  *       owns smuggling detection; the safe-* terminator scanner

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.8",
+  "version": "0.13.13",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",