@blamejs/blamejs-shop 0.3.4 → 0.3.6

package/lib/vendor/blamejs/lib/web-push-vapid.js

@@ -64,7 +64,7 @@ function generateVapidKeypair() {
   var pubKeyObj = nodeCrypto.createPublicKey(kp.publicKey);
   var jwk = pubKeyObj.export({ format: "jwk" });
   var raw = Buffer.concat([
-    Buffer.from([0x04]),                                                                              // allow:raw-byte-literal — uncompressed point prefix per SEC1 §2.3.3
+    Buffer.from([0x04]),                                                                              // uncompressed point prefix per SEC1 §2.3.3
     Buffer.from(jwk.x, "base64url"),
     Buffer.from(jwk.y, "base64url"),
   ]);
@@ -153,31 +153,31 @@ function buildVapidAuthHeader(opts) {
   // node:crypto produces DER-encoded ECDSA signature; JWT ES256
   // requires the raw 64-byte r||s shape. Convert.
   var derSig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "utf8"), keyObj);
-  var rawSig = _ecdsaDerToRaw(derSig, 32);                                                            // allow:raw-byte-literal — 32-byte P-256 component
+  var rawSig = _ecdsaDerToRaw(derSig, 32);                                                            // 32-byte P-256 component
   var token = signingInput + "." + bCrypto.toBase64Url(rawSig);
   return "vapid t=" + token + ", k=" + opts.publicKeyB64Url;
 }
 
 function _ecdsaDerToRaw(der, componentLen) {
   // ECDSA-Sig-Value DER = SEQUENCE { r INTEGER, s INTEGER }.
-  if (der[0] !== 0x30) {                                                                              // allow:raw-byte-literal — ASN.1 SEQUENCE tag
+  if (der[0] !== 0x30) {                                                                              // ASN.1 SEQUENCE tag
     throw new WebPushError("web-push/bad-sig",
       "ECDSA signature is not a DER SEQUENCE");
   }
   var off = 2;
-  if (der[1] & 0x80) off = 2 + (der[1] & 0x7f);                                                       // allow:raw-byte-literal — long-form length byte
-  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing r INTEGER");             // allow:raw-byte-literal — ASN.1 INTEGER tag
+  if (der[1] & 0x80) off = 2 + (der[1] & 0x7f);                                                       // long-form length byte
+  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing r INTEGER");             // ASN.1 INTEGER tag
   var rLen = der[off + 1];
   var rStart = off + 2;
   var r = der.slice(rStart, rStart + rLen);
   off = rStart + rLen;
-  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing s INTEGER");             // allow:raw-byte-literal — ASN.1 INTEGER tag
+  if (der[off] !== 0x02) throw new WebPushError("web-push/bad-sig", "missing s INTEGER");             // ASN.1 INTEGER tag
   var sLen = der[off + 1];
   var sStart = off + 2;
   var s = der.slice(sStart, sStart + sLen);
   // Trim leading zero pad (DER requires it when high bit set; JWT raw doesn't).
-  if (r.length > componentLen && r[0] === 0x00) r = r.slice(1);                                        // allow:raw-byte-literal — DER sign-bit pad
-  if (s.length > componentLen && s[0] === 0x00) s = s.slice(1);                                        // allow:raw-byte-literal — DER sign-bit pad
+  if (r.length > componentLen && r[0] === 0x00) r = r.slice(1);                                        // DER sign-bit pad
+  if (s.length > componentLen && s[0] === 0x00) s = s.slice(1);                                        // DER sign-bit pad
   var out = Buffer.alloc(componentLen * 2);
   r.copy(out, componentLen - r.length);
   s.copy(out, componentLen * 2 - s.length);
@@ -245,12 +245,12 @@ function encrypt(opts) {
   }
   // Decode the subscription's p256dh + auth.
   var recipientPubRaw = Buffer.from(opts.subscription.keys.p256dh, "base64url");
-  if (recipientPubRaw.length !== 65 || recipientPubRaw[0] !== 0x04) {                                 // allow:raw-byte-literal — uncompressed P-256 point shape per SEC1 §2.3.3
+  if (recipientPubRaw.length !== 65 || recipientPubRaw[0] !== 0x04) {                                 // uncompressed P-256 point shape per SEC1 §2.3.3
     throw new WebPushError("web-push/bad-p256dh",
       "encrypt: p256dh must be a 65-byte uncompressed P-256 point");
   }
   var authSecret = Buffer.from(opts.subscription.keys.auth, "base64url");
-  if (authSecret.length !== 16) {                                                                     // allow:raw-byte-literal — RFC 8291 §3.2 auth_secret length
+  if (authSecret.length !== 16) {                                                                     // RFC 8291 §3.2 auth_secret length
     throw new WebPushError("web-push/bad-auth",
       "encrypt: auth must be a 16-byte secret (got " + authSecret.length + ")");
   }
@@ -259,7 +259,7 @@ function encrypt(opts) {
   ephemeral.generateKeys();
   var ephemeralPubRaw = ephemeral.getPublicKey();   // uncompressed 65 bytes
   // ECDH shared secret.
-  var sharedSecret = ephemeral.computeSecret(recipientPubRaw);                                       // allow:raw-byte-literal — ECDH shared secret (32 bytes per P-256)
+  var sharedSecret = ephemeral.computeSecret(recipientPubRaw);                                       // ECDH shared secret (32 bytes per P-256)
   // RFC 8291 §3.4 two-stage HKDF:
   //   PRK_key = HKDF-Extract(salt=auth_secret, IKM=ECDH_shared)
   //   key_info = "WebPush: info\x00" || ua_public || as_public
@@ -276,23 +276,23 @@ function encrypt(opts) {
     recipientPubRaw,
     ephemeralPubRaw,
   ]);
-  var ikm = _hkdf(authSecret, sharedSecret, keyInfo, 32);                                              // allow:raw-byte-literal — 256-bit IKM
-  var salt = nodeCrypto.randomBytes(16);                                                              // allow:raw-byte-literal — RFC 8188 §2.2 16-byte salt
-  var cek   = _hkdf(salt, ikm, Buffer.from("Content-Encoding: aes128gcm\x00", "utf8"), 16);            // allow:raw-byte-literal — 128-bit AEAD key
-  var nonce = _hkdf(salt, ikm, Buffer.from("Content-Encoding: nonce\x00",     "utf8"), 12);            // allow:raw-byte-literal — 96-bit AEAD nonce
+  var ikm = _hkdf(authSecret, sharedSecret, keyInfo, 32);                                              // 256-bit IKM
+  var salt = nodeCrypto.randomBytes(16);                                                              // RFC 8188 §2.2 16-byte salt
+  var cek   = _hkdf(salt, ikm, Buffer.from("Content-Encoding: aes128gcm\x00", "utf8"), 16);            // 128-bit AEAD key
+  var nonce = _hkdf(salt, ikm, Buffer.from("Content-Encoding: nonce\x00",     "utf8"), 12);            // 96-bit AEAD nonce
   // RFC 8188 §2 padding: plaintext || 0x02 (delimiter for single-record).
   // RFC 8291 mandates single-record (record_size > plaintext+padding+tag).
-  var padded = Buffer.concat([plaintext, Buffer.from([0x02])]);                                        // allow:raw-byte-literal — RFC 8188 single-record delimiter
+  var padded = Buffer.concat([plaintext, Buffer.from([0x02])]);                                        // RFC 8188 single-record delimiter
   var cipher = nodeCrypto.createCipheriv("aes-128-gcm", cek, nonce);
   var ct = Buffer.concat([cipher.update(padded), cipher.final()]);
   var tag = cipher.getAuthTag();
   // RFC 8188 §2.1 header: salt(16) || rs(4 big-endian) || idlen(1) || keyid
   // For RFC 8291 the keyid is the as_public (ephemeral pubkey, 65 bytes).
-  var rs = padded.length + 16;                                                                        // allow:raw-byte-literal — record size = plaintext + tag length
-  var header = Buffer.alloc(16 + 4 + 1);                                                              // allow:raw-byte-literal — salt + rs + idlen layout
+  var rs = padded.length + 16;                                                                        // record size = plaintext + tag length
+  var header = Buffer.alloc(16 + 4 + 1);                                                              // salt + rs + idlen layout
   salt.copy(header, 0);
-  header.writeUInt32BE(rs, 16);                                                                       // allow:raw-byte-literal — salt offset
-  header[20] = ephemeralPubRaw.length;                                                                // allow:raw-byte-literal — rs offset
+  header.writeUInt32BE(rs, 16);                                                                       // salt offset
+  header[20] = ephemeralPubRaw.length;                                                                // rs offset
   var body = Buffer.concat([header, ephemeralPubRaw, ct, tag]);
   var ttlSec = opts.ttlSec || (28 * 24 * 3600);                                                       // allow:raw-time-literal — RFC 8030 §5.2 default
   return {
@@ -309,7 +309,7 @@ function _hkdf(salt, ikm, info, length) {
   // RFC 5869 HKDF-Extract + Expand using SHA-256 (per RFC 8291 / 8188).
   var prk = nodeCrypto.createHmac("sha256", salt).update(ikm).digest();
   // Expand with one-byte counter (length <= 32 always in this use).
-  var t = Buffer.concat([info, Buffer.from([0x01])]);                                                 // allow:raw-byte-literal — HKDF counter start
+  var t = Buffer.concat([info, Buffer.from([0x01])]);                                                 // HKDF counter start
   var out = nodeCrypto.createHmac("sha256", prk).update(t).digest();
   return out.slice(0, length);
 }

package/lib/vendor/blamejs/lib/webhook.js

@@ -751,7 +751,7 @@ function _writeError(res, status, code, message) {
 // b.crypto.timingSafeEqual — never `===`.
 
 var STRIPE_HMAC_ALG = "hmac-sha256-stripe";
-var STRIPE_SIG_MAX_HEX = 256;                                                                          // allow:raw-byte-literal — hex-char anti-DoS cap, not bytes
+var STRIPE_SIG_MAX_HEX = 256;                                                                          // hex-char anti-DoS cap, not bytes
 var STRIPE_DEFAULT_TOLERANCE_MS = C.TIME.minutes(5);                                                   // RFC 3161-ish 5 minute window default
 var STRIPE_MIN_TOLERANCE_MS = C.TIME.seconds(30);                                                      // refuse below 30s
 
@@ -764,7 +764,7 @@ function _parseStripeSignatureHeader(header) {
     throw new WebhookError("webhook/bad-stripe-header",
       "verify: Stripe-Signature header must be a non-empty string");
   }
-  if (header.length > 4096) {                                                                          // allow:raw-byte-literal — anti-DoS header cap
+  if (header.length > 4096) {                                                                          // anti-DoS header cap
     throw new WebhookError("webhook/bad-stripe-header",
       "verify: Stripe-Signature header exceeds 4096 bytes");
   }

package/lib/vendor/blamejs/lib/websocket.js

@@ -189,9 +189,9 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 // IANA-registered. 4000..4999 are private-use. Anything else is
 // invalid.
 function _isValidCloseCode(code) {
-  if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // allow:raw-byte-literal — RFC 6455 §7.4.2 reserved codes
-  if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 spec range / allow:raw-time-literal — code is a numeric, not seconds
-  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 IANA / private range / allow:raw-time-literal — code is a numeric, not seconds
+  if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
+  if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
   return false;
 }
 
@@ -1322,7 +1322,7 @@ function handleUpgrade(req, socket, head, opts) {
   // breaking the upgrade in a way that's hard to diagnose; the format
   // check at the top of handleUpgrade catches it loudly. Empty /
   // undefined falls through to the RFC default in computeAcceptKey.
-  var GUID_MAX_LENGTH = C.BYTES.bytes(64); // allow:raw-byte-literal — UUID is 36 chars; 64 is a tolerant upper bound for the regex engine.
+  var GUID_MAX_LENGTH = C.BYTES.bytes(64); // UUID is 36 chars; 64 is a tolerant upper bound for the regex engine.
   if (opts.handshakeGuid !== undefined && opts.handshakeGuid !== null) {
     // Length cap before the regex test — UUIDs are exactly 36 chars so
     // a > GUID_MAX_LENGTH input never matches the format and shouldn't
@@ -1341,7 +1341,7 @@ function handleUpgrade(req, socket, head, opts) {
   // consumer would expect for a malformed request.
   var v = validateUpgradeRequest(req, opts);
   if (!v.ok) {
-    _refuseUpgrade(socket, v.status || 400, v.reason);          // allow:raw-byte-literal — HTTP 400 fallback
+    _refuseUpgrade(socket, v.status || 400, v.reason);          // HTTP 400 fallback
     return null;
   }
 

package/lib/vendor/blamejs/lib/worker-pool.js

@@ -77,9 +77,9 @@ var { WorkerPoolError } = require("./framework-error");
 var audit = lazyRequire(function () { return require("./audit"); });
 
 var MIN_SIZE = 1;
-var MAX_SIZE = 256;                                                              // allow:raw-byte-literal — sanity ceiling on worker count, not bytes
-var DEFAULT_MAX_QUEUE_DEPTH = 1024;                                              // allow:raw-byte-literal — task-queue depth, not bytes
-var MAX_QUEUE_DEPTH_CAP = 1048576;                                               // allow:raw-byte-literal — task-queue depth ceiling, not bytes
+var MAX_SIZE = 256;                                                              // sanity ceiling on worker count, not bytes
+var DEFAULT_MAX_QUEUE_DEPTH = 1024;                                              // task-queue depth, not bytes
+var MAX_QUEUE_DEPTH_CAP = 1048576;                                               // task-queue depth ceiling, not bytes
 var DEFAULT_TASK_TIMEOUT_MS = C.TIME.minutes(5);
 var MAX_TASK_TIMEOUT_MS = C.TIME.hours(1);
 

package/lib/vendor/blamejs/lib/ws-client.js

@@ -76,16 +76,16 @@ var DEFAULT_RECONNECT_BASE_MS    = C.TIME.seconds(1) / 2;
 var DEFAULT_RECONNECT_MAX_MS     = C.TIME.seconds(30);
 var DEFAULT_RECONNECT_MAX_ATTEMPTS = 10;
 
-var OPCODE_CONT   = 0x00;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_TEXT   = 0x01;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_BINARY = 0x02;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_CLOSE  = 0x08;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_PING   = 0x09;                                // allow:raw-byte-literal — RFC 6455 opcode
-var OPCODE_PONG   = 0x0A;                                // allow:raw-byte-literal — RFC 6455 opcode
+var OPCODE_CONT   = 0x00;                                // RFC 6455 opcode
+var OPCODE_TEXT   = 0x01;                                // RFC 6455 opcode
+var OPCODE_BINARY = 0x02;                                // RFC 6455 opcode
+var OPCODE_CLOSE  = 0x08;                                // RFC 6455 opcode
+var OPCODE_PING   = 0x09;                                // RFC 6455 opcode
+var OPCODE_PONG   = 0x0A;                                // RFC 6455 opcode
 
-var CLOSE_NORMAL          = 1000;                        // allow:raw-byte-literal — RFC 6455 close code
-var CLOSE_GOING_AWAY      = 1001;                        // allow:raw-byte-literal — RFC 6455 close code
-var CLOSE_ABNORMAL        = 1006;                        // allow:raw-byte-literal — RFC 6455 close code (synthetic — never on wire)
+var CLOSE_NORMAL          = 1000;                        // RFC 6455 close code
+var CLOSE_GOING_AWAY      = 1001;                        // RFC 6455 close code
+var CLOSE_ABNORMAL        = 1006;                        // RFC 6455 close code (synthetic — never on wire)
 
 // Permanent vs transient error classifier — used by reconnect logic
 // so client doesn't hammer the server on credentials / handshake
@@ -360,7 +360,7 @@ class WsClient extends EventEmitter {
 
     var parsed = dialParsed;
     var port = parsed.port ? parseInt(parsed.port, 10) :
-               (parsed.protocol === "wss:" ? 443 : 80);                                  // allow:raw-byte-literal — TLS / HTTP default port
+               (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
 
     function _onError(err) { self._handleSocketError(err); }
@@ -443,7 +443,7 @@ class WsClient extends EventEmitter {
       "Upgrade: websocket",
       "Connection: Upgrade",
       "Sec-WebSocket-Key: " + key,
-      "Sec-WebSocket-Version: 13",                                                       // allow:raw-byte-literal — RFC 6455 §1.9
+      "Sec-WebSocket-Version: 13",                                                       // RFC 6455 §1.9
     ];
     if (opts.origin) {
       if (safeBuffer.hasCrlf(opts.origin)) {
@@ -510,7 +510,7 @@ class WsClient extends EventEmitter {
       return;
     }
     var status = parseInt(match[1], 10);
-    if (status !== 101) {                                                                 // allow:raw-byte-literal — HTTP 101
+    if (status !== 101) {                                                                 // HTTP 101
       // Body bytes after the header section are the server's
       // explanation. Surface them on the error so callers can branch
       // on the status code and inspect the body without re-parsing
@@ -560,7 +560,7 @@ class WsClient extends EventEmitter {
     this._negotiatedSubprotocol = negotiatedSubprotocol;
 
     this._negotiatedDeflate = false;
-    this._negotiatedWindowBits = 15;                                                      // allow:raw-byte-literal — RFC 7692 default windowBits
+    this._negotiatedWindowBits = 15;                                                      // RFC 7692 default windowBits
     if (this._opts.permessageDeflate &&
         (headers["sec-websocket-extensions"] || "").indexOf("permessage-deflate") !== -1) {
       this._negotiatedDeflate = true;
@@ -572,7 +572,7 @@ class WsClient extends EventEmitter {
       var smwbMatch = extLine.match(/server_max_window_bits\s*=\s*"?(\d+)"?/);             // allow:regex-no-length-cap — bounded by header line + RFC 7692 §7.1
       if (smwbMatch) {
         var smwb = parseInt(smwbMatch[1], 10);
-        if (smwb < 8 || smwb > 15) {                                                      // allow:raw-byte-literal — RFC 7692 windowBits range
+        if (smwb < 8 || smwb > 15) {                                                      // RFC 7692 windowBits range
           this._handleSocketError(new WsClientError("ws-client/deflate-error",
             "server_max_window_bits=" + smwb + " is outside RFC 7692 range [8, 15]"));
           return;
@@ -635,7 +635,7 @@ class WsClient extends EventEmitter {
                     frame.opcode === OPCODE_PONG ||
                     frame.opcode === OPCODE_CLOSE;
     if (isControl) {
-      if (frame.payload.length > 125) {                                                   // allow:raw-byte-literal — RFC 6455 §5.5 control-frame cap
+      if (frame.payload.length > 125) {                                                   // RFC 6455 §5.5 control-frame cap
         this._handleSocketError(new WsClientError("ws-client/control-too-big",
           "control-frame payload exceeds 125 bytes (RFC 6455 §5.5)"));
         return;
@@ -665,7 +665,7 @@ class WsClient extends EventEmitter {
       var code = CLOSE_NORMAL, reason = "";
       if (frame.payload.length >= 2) {
         code = frame.payload.readUInt16BE(0);
-        var reasonBytes = frame.payload.subarray(2);                                      // allow:raw-byte-literal — RFC 6455 close-frame layout
+        var reasonBytes = frame.payload.subarray(2);                                      // RFC 6455 close-frame layout
         try {
           reason = new TextDecoder("utf-8", { fatal: true }).decode(reasonBytes);
         } catch (_e) {
@@ -711,7 +711,7 @@ class WsClient extends EventEmitter {
       if (this._negotiatedDeflate && firstFrameRsv1) {
         try {
           var zlib = require("node:zlib");                                                     // allow:inline-require — zlib only on deflate-negotiated path
-          var compressed = Buffer.concat([fullPayload, Buffer.from([0x00, 0x00, 0xff, 0xff])]); // allow:raw-byte-literal — RFC 7692 §7.2.2 deflate trailer
+          var compressed = Buffer.concat([fullPayload, Buffer.from([0x00, 0x00, 0xff, 0xff])]); // RFC 7692 §7.2.2 deflate trailer
           // Decompression-bomb defense: zlib.inflateRawSync's
           // `maxOutputLength` aborts the inflate the moment the
           // output would exceed maxMessageBytes — never decode GBs
@@ -828,26 +828,26 @@ class WsClient extends EventEmitter {
     // mid-codepoint — to be RFC-safe we truncate at code-point
     // boundaries.
     var rb = Buffer.from(reason, "utf8");
-    if (rb.length > 123) {                                                                // allow:raw-byte-literal — RFC 6455 §5.5 (125 - 2)
+    if (rb.length > 123) {                                                                // RFC 6455 §5.5 (125 - 2)
       // Truncate at last complete codepoint within 123 bytes. Use a
       // fatal TextDecoder to validate; back off one byte at a time
       // until the slice decodes cleanly. Bounded by [123 - 3, 123]
       // since a single UTF-8 codepoint is at most 4 bytes.
       var fatal = new TextDecoder("utf-8", { fatal: true });
-      var truncated = rb.subarray(0, 123);                                                // allow:raw-byte-literal — RFC 6455 §5.5
-      for (var bi = 0; bi < 4; bi += 1) {                                                 // allow:raw-byte-literal — max UTF-8 codepoint width
+      var truncated = rb.subarray(0, 123);                                                // RFC 6455 §5.5
+      for (var bi = 0; bi < 4; bi += 1) {                                                 // max UTF-8 codepoint width
         try { fatal.decode(truncated); break; }
         catch (_e) { truncated = truncated.subarray(0, truncated.length - 1); }
       }
       rb = truncated;
     }
-    var payload = Buffer.alloc(2 + rb.length);                                            // allow:raw-byte-literal — RFC 6455 close-frame layout
+    var payload = Buffer.alloc(2 + rb.length);                                            // RFC 6455 close-frame layout
     payload.writeUInt16BE(code, 0);
-    rb.copy(payload, 2);                                                                  // allow:raw-byte-literal — RFC 6455 close-frame layout
+    rb.copy(payload, 2);                                                                  // RFC 6455 close-frame layout
     this._readyState = "closing";
     this._sendFrame(OPCODE_CLOSE, payload, { fin: true });
     var self = this;
-    setTimeout(function () { self._teardown(code, reason, false); }, 1000).unref();       // allow:raw-byte-literal — graceful close grace window
+    setTimeout(function () { self._teardown(code, reason, false); }, 1000).unref();       // graceful close grace window
   }
 
   _teardown(code, reason, willReconnect) {
@@ -921,7 +921,7 @@ class WsClient extends EventEmitter {
   _scheduleReconnect() {
     var rOpts = this._opts.reconnectOpts;
     this._reconnectAttempt += 1;
-    var attempt = Math.min(this._reconnectAttempt, 30);                                   // allow:raw-byte-literal — clamp 2^attempt overflow
+    var attempt = Math.min(this._reconnectAttempt, 30);                                   // clamp 2^attempt overflow
     var ceiling = Math.min(rOpts.maxMs, rOpts.baseMs * Math.pow(2, attempt - 1));
     var delay   = Math.floor(Math.random() * ceiling);                                    // allow:math-random-noncrypto — backoff jitter, not security
     var self = this;

package/lib/vendor/blamejs/lib/xml-c14n.js

@@ -62,7 +62,7 @@ var XmlC14nError = defineClass("XmlC14nError", { alwaysPermanent: true });
 function _xmlErr(code, message) { return new XmlC14nError(code, message); }
 
 var MAX_INPUT_BYTES = 8 * 1024 * 1024;                                                          // allow:raw-byte-literal — XML doc cap (8 MiB)
-var MAX_DEPTH       = 200;                                                                      // allow:raw-byte-literal — element nesting depth ceiling
+var MAX_DEPTH       = 200;                                                                      // element nesting depth ceiling
 
 /**
  * @primitive b.xmlC14n.parse
@@ -172,7 +172,7 @@ function parse(xml) {
           if (name.charAt(0) === "#") {
             var code;
             if (name.charAt(1) === "x" || name.charAt(1) === "X") {
-              code = parseInt(name.slice(2), 16);                                              // allow:raw-byte-literal — hex radix
+              code = parseInt(name.slice(2), 16);                                              // hex radix
             } else {
               code = parseInt(name.slice(1), 10);
             }

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.46",
+  "version": "0.14.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",