@blamejs/blamejs-shop 0.4.69 → 0.4.70

package/lib/vendor/blamejs/lib/webhook.js

@@ -48,6 +48,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
 var httpClient = require("./http-client");
 var safeBuffer = require("./safe-buffer");
@@ -57,6 +58,8 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
+// Lazy — ssrf-guard pulls in the DNS/network stack; only touched on send().
+var ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 var validateOpts = require("./validate-opts");
 var { WebhookError } = require("./framework-error");
 // b.webhook.dispatcher — durable signed-webhook delivery store. Lives in its
@@ -428,6 +431,18 @@ function signer(opts) {
       allowedProtocols: httpOpts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
       errorClass:       WebhookError,
     });
+    // SSRF gate at the webhook layer: refuse private / loopback / link-local /
+    // cloud-metadata destinations up front, before the retry loop. httpClient
+    // also enforces this on every request, but checking here fails fast (no
+    // wasted retries) and keeps the SSRF boundary explicit at the send() API
+    // rather than relying on the transport's internal gate. allowInternal
+    // mirrors the operator's http opts (its affirmative waiver).
+    try {
+      await ssrfGuard().checkUrl(url, { allowInternal: httpOpts.allowInternal === true });
+    } catch (e) {
+      if (e && e.isSsrfError) throw _err("SSRF_REFUSED", "webhook.signer.send: " + e.message);
+      throw e;
+    }
     _validateBody(body);
     var signed = sign(body, { kid: input.kid });
     var mergedHeaders = Object.assign({}, input.headers || {}, signed.headers);
@@ -645,7 +660,7 @@ function verifier(opts) {
       throw _failure("MISSING_TIMESTAMP", "webhook: t= field missing from signature header", "missing-timestamp", ctxReq);
     }
     var ts = Number(parsed.t);
-    if (!isFinite(ts) || ts < 0 || Math.floor(ts) !== ts) {
+    if (!numericBounds.isNonNegativeFiniteInt(ts)) {
       throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
     }
     if (parsed.id === null || parsed.id.length === 0) {

package/lib/vendor/blamejs/lib/websocket.js

@@ -573,7 +573,7 @@ function _negotiatePermessageDeflate(reqHeader) {
       "server_max_window_bits": true,     "client_max_window_bits": true,
     };
     var ok = true;
-    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !KNOWN[k]) { ok = false; break; } }
+    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !Object.prototype.hasOwnProperty.call(KNOWN, k)) { ok = false; break; } }
     if (!ok) continue;
     // Always negotiate WITH no_context_takeover in BOTH directions, so
     // every message uses a fresh zlib state. Echo any client window-

package/lib/vendor/blamejs/lib/worm.js

@@ -102,7 +102,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, ["store", "mode", "defaultRetentionMs", "clock"], "worm.create");
   var mode = opts.mode || "compliance";
-  if (!MODES[mode]) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
+  if (!Object.prototype.hasOwnProperty.call(MODES, mode)) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
   var store = opts.store || _memStore();
   ["get", "set", "delete", "has", "keys"].forEach(function (m) {
     if (typeof store[m] !== "function") throw new WormError("worm/bad-store", "worm.create: store adapter must implement " + m + "()");

package/lib/vendor/blamejs/lib/ws-client.js

@@ -248,17 +248,13 @@ function connect(target, opts) {
   });
   // SSRF gate — refuse private / loopback / link-local / cloud-metadata /
   // reserved IP destinations by default. Symmetric to b.httpClient. The
-  // returned `ips` are pinned through tls.connect / net.connect so the
+  // validated `ips` are pinned through tls.connect / net.connect so the
   // actual TCP connect targets the validated address (closes the DNS-
   // rebinding TOCTOU window). Cloud-metadata IPs are unconditional
-  // hard-deny — `allowInternal: true` does not bypass them.
-  var hostnameForUrl = parsed.protocol === "wss:" ? "https:" : "http:";
-  var probeUrl = new nodeUrl.URL(hostnameForUrl + "//" + parsed.host + parsed.pathname + parsed.search);
-  ssrfGuard.checkUrl(probeUrl, {
-    allowInternal: opts.allowInternal,
-    errorClass:    WsClientError,
-  }).then(function (result) {
-    client._ssrfPinnedIps = result && result.ips;
+  // hard-deny — `allowInternal: true` does not bypass them. _prepareDial
+  // performs the (async) check + pinning before the dial and reruns it on
+  // every reconnect, so a urlFor-swapped target is validated too.
+  client._prepareDial().then(function () {
     client._dial();
   }).catch(function (e) {
     setImmediate(function () { client._handleSocketError(e); });
@@ -315,51 +311,50 @@ class WsClient extends EventEmitter {
   get subprotocol()            { return this._negotiatedSubprotocol; }
   get url()                    { return this._opts.target; }
 
-  _dial() {
-    var self = this;
+  // Resolve the dial target and re-validate it BEFORE any socket opens.
+  // urlFor may swap the URL and tlsOptsFor may rotate TLS material every
+  // dial (including reconnects). The resolved target is re-checked through
+  // ssrfGuard — AWAITED, because checkUrl is async: the prior code called it
+  // synchronously inside _dial and discarded the Promise, so a urlFor that
+  // pointed at a private / cloud-metadata address mid-reconnect was connected
+  // anyway (the SSRF rejection surfaced only as an unhandled rejection) and
+  // the connect was never pinned. Returns a Promise; sync throws from
+  // urlFor / tlsOptsFor become rejections (async fn) handled by the caller.
+  async _prepareDial() {
     var opts = this._opts;
-    this._readyState = "connecting";
-
-    // Per-dial overrides — urlFor swaps the target URL, tlsOptsFor
-    // overrides TLS material. Both fire every dial including reconnects
-    // so callers can rotate state. urlFor's result is re-validated
-    // through ssrfGuard so a hostile upstream can't direct the client
-    // at a private address mid-reconnect.
     var attempt = this._reconnectAttempt || 0;
-    var dialTarget = opts.target;
     var dialParsed = opts.parsedUrl;
     if (typeof opts.urlFor === "function") {
-      try {
-        var nextTarget = opts.urlFor(attempt);
-        if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== dialTarget) {
-          dialParsed = _parseUrl(nextTarget);
-          dialTarget = nextTarget;
-          var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
-          var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
-          var probe = ssrfGuard.checkUrl(probeUrl, {
-            allowInternal: opts.allowInternal,
-            errorClass:    WsClientError,
-          });
-          this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var nextTarget = opts.urlFor(attempt);
+      if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== opts.target) {
+        dialParsed = _parseUrl(nextTarget);
       }
     }
-
     var dialTlsOpts = opts.tlsOpts;
     if (typeof opts.tlsOptsFor === "function") {
-      try {
-        var override = opts.tlsOptsFor(attempt);
-        if (override && typeof override === "object") {
-          dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var override = opts.tlsOptsFor(attempt);
+      if (override && typeof override === "object") {
+        dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
       }
     }
+    var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
+    var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
+    var probe = await ssrfGuard.checkUrl(probeUrl, {
+      allowInternal: opts.allowInternal,
+      errorClass:    WsClientError,
+    });
+    this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
+    this._dialParsed    = dialParsed;
+    this._dialTlsOpts   = dialTlsOpts;
+  }
+
+  _dial() {
+    var self = this;
+    this._readyState = "connecting";
 
-    var parsed = dialParsed;
+    // Target + TLS material were resolved and SSRF-validated by _prepareDial.
+    var parsed = this._dialParsed || this._opts.parsedUrl;
+    var dialTlsOpts = this._dialTlsOpts || this._opts.tlsOpts;
     var port = parsed.port ? parseInt(parsed.port, 10) :
                (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
@@ -422,8 +417,8 @@ class WsClient extends EventEmitter {
 
     this._handshakeTimer = setTimeout(function () {
       self._handleSocketError(new WsClientError("ws-client/handshake-timeout",
-        "Handshake exceeded " + opts.handshakeTimeoutMs + "ms"));
-    }, opts.handshakeTimeoutMs);
+        "Handshake exceeded " + self._opts.handshakeTimeoutMs + "ms"));
+    }, self._opts.handshakeTimeoutMs);
     if (typeof this._handshakeTimer.unref === "function") this._handshakeTimer.unref();
   }
 
@@ -644,6 +639,17 @@ class WsClient extends EventEmitter {
         return;
       }
     }
+    // Fail the connection on any opcode outside the six RFC 6455 §5.2-defined
+    // values (CONT/TEXT/BINARY/CLOSE/PING/PONG). Without this, a reserved
+    // opcode (0x3-0x7, 0xB-0xF) from a malicious server fell through every
+    // branch to the FIN block and emitted a (stale/empty) message — a
+    // fragmented-message desync / frame-injection lever.
+    if (frame.opcode !== OPCODE_CONT && frame.opcode !== OPCODE_TEXT &&
+        frame.opcode !== OPCODE_BINARY && !isControl) {
+      this._handleSocketError(new WsClientError("ws-client/reserved-opcode",
+        "reserved/unknown WebSocket opcode 0x" + frame.opcode.toString(16) + " (RFC 6455 §5.2)"));
+      return;
+    }
     // Continuation frames MUST NOT carry rsv1 (RFC 7692 §6.1) — only
     // the first frame of a compressed message sets rsv1.
     if (frame.opcode === OPCODE_CONT && frame.rsv1) {
@@ -926,7 +932,12 @@ class WsClient extends EventEmitter {
     this._reconnectTimer = setTimeout(function () {
       self._reconnectTimer = null;
       if (self._closed) return;                                                           // operator-cancelled in flight
-      self._dial();
+      // Re-resolve + re-validate the target (urlFor swap, DNS rebind) before
+      // reconnecting — awaited, so a now-private/metadata address is refused.
+      self._prepareDial().then(function () {
+        if (self._closed) return;
+        self._dial();
+      }).catch(function (e) { self._handleSocketError(e); });
     }, delay);
     if (typeof this._reconnectTimer.unref === "function") this._reconnectTimer.unref();
     this.emit("reconnecting", { attempt: this._reconnectAttempt, delayMs: delay });

package/lib/vendor/blamejs/lib/x509-chain.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// Internal X.509 path-validation helpers shared by the framework's
+// certificate-chain walkers (b.tsa.verifyToken, b.mail.bimi VMC/CMC,
+// b.mail.crypto.smime.verify). They exist because node:crypto's
+// X509Certificate.checkIssued() validates the issuer/subject DN match,
+// the AKI/SKI linkage, and — when a keyUsage extension is present —
+// keyCertSign, but it does NOT enforce basicConstraints cA:TRUE. A
+// leaf / end-entity certificate (cA:FALSE) that omits keyUsage is
+// therefore wrongly accepted as a signing CA for the next cert in the
+// chain — the classic basicConstraints bypass (CVE-2002-0862 class).
+// Every chain walker routes its issuer test through these helpers so the
+// cA enforcement can never be forgotten in one walker but present in
+// another.
+
+// True only when `cert` asserts basicConstraints cA:TRUE. node's
+// X509Certificate exposes `.ca` (a boolean); a cert with no
+// basicConstraints extension or with cA:FALSE returns false. A missing
+// cert or a non-boolean `.ca` (parse failure / unsupported runtime)
+// fails closed.
+function isCaCert(cert) {
+  return !!cert && cert.ca === true;
+}
+
+// True when `issuer` validly issued `subject` AND is itself a CA: the
+// DN / AKI-SKI / keyUsage linkage (checkIssued), the cryptographic
+// signature (verify), and basicConstraints cA:TRUE (isCaCert). The cA
+// check runs first so a non-CA cert is rejected before the expensive
+// signature verification. Any exception (malformed cert, unsupported
+// key type) fails closed to false.
+function issuerValidlyIssued(issuer, subject) {
+  try {
+    return isCaCert(issuer) &&
+      subject.checkIssued(issuer) &&
+      subject.verify(issuer.publicKey);
+  } catch (_e) {
+    return false;
+  }
+}
+
+module.exports = {
+  isCaCert:            isCaCert,
+  issuerValidlyIssued: issuerValidlyIssued,
+};

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.13",
+  "version": "0.15.14",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.14.json

@@ -0,0 +1,122 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.14",
+  "date": "2026-06-20",
+  "headline": "A broad security-hardening release: every request-IP trust decision is peer-gated against the immediate connection (closing an X-Forwarded-For spoofing class — one behavior change, see Migration), a wide set of authentication and signature verifiers now fail closed, pre-auth parsers are hardened against algorithmic-complexity and frame-desync attacks, and untrusted-key allowlist lookups, at-rest encryption binding, and on-disk writes are tightened framework-wide; adds streaming and exclusive atomic-write primitives, a script-context JSON serializer, and HTTP-client bandwidth throttling",
+  "summary": "This release tightens existing protections across the framework rather than adding opt-ins. The headline behavior change is how the client IP is trusted: the IP gates that make security decisions (network allowlist, rate limiter, break-glass grant pin) no longer trust a bare leftmost X-Forwarded-For value when trustProxy is set without an explicit proxy allowlist — they resolve the client IP by a peer-gated right-to-left walk anchored at the connecting socket, so a direct caller can no longer forge an allowed address. Operators who terminate behind a proxy now declare its address range in trustedProxies (see Migration). Alongside that, a large set of verifiers that could accept a malformed or unsigned credential now fail closed (SAML audience restriction, FDA electronic-signature, SD-JWT key-binding replay, DPoP, CIBA, mdoc trust anchor, COSE algorithm/curve binding, agent-snapshot plaintext under a regulated posture); pre-authentication parsers that an attacker reaches before any credential check are hardened against quadratic-time and frame-desync denial of service (CBOR, JSONPath, tar/PAX, gzip, YAML, ASN.1 DER, the scheduler's timer math); allowlist and posture lookups keyed by untrusted input can no longer reach Object.prototype; the framework's own file writes are now symlink-refusing and atomic; at-rest and egress paths bind ciphertext to its location and redact nested secrets; and several lost-update races are serialized. New surface is additive: streaming and exclusive atomic-write primitives, a serializer safe to embed in an inline <script>, and download/upload bandwidth throttling on the HTTP client.",
+  "sections": [
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "X-Forwarded-For trust now requires an explicit proxy allowlist",
+          "body": "The IP gates that enforce a security decision — network allowlist, rate limiter, and the break-glass grant IP pin — previously resolved the client IP from the leftmost X-Forwarded-For value whenever trustProxy was truthy. A direct caller could set that header to any address and walk an IP allowlist or evade a rate-limit key (CWE-290 / CWE-348). These gates now fail closed: with trustProxy set but no trustedProxies, they ignore X-Forwarded-For and use the connecting socket's peer address. To keep trusting a forwarded client IP, set trustedProxies to the CIDR(s) of your front proxy/load balancer — the client IP is then resolved by a peer-gated right-to-left walk that stops at the first hop not in the allowlist. For an allowlist / rate-limit / break-glass gate the new default is stricter (it trusts less), so an operator who has not migrated sees tighter enforcement, never looser. Display-only consumers (error pages, request logs) keep the lenient resolution and carry a docstring warning. The wiki example's WIKI_TRUST_PROXY flag is replaced by WIKI_ADMIN_TRUSTED_PROXIES (a CIDR list)."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.atomicFile.writeStream(filepath, source, opts?) and b.atomicFile.writeExclSync(filepath, data, opts?)",
+          "body": "Two atomic-write primitives that complete the read-side fdSafeReadSync family. writeStream writes a stream to a fresh O_EXCL|O_NOFOLLOW temporary file with an output-byte cap, then renames into place; writeExclSync stages a synchronous write through a verify-then-rename (clearing any stale temp under O_EXCL|O_NOFOLLOW first) for the small sealed-state round-trips (vault seal / unseal / rotate). Both refuse to follow a symlink at the destination or temp path, so an attacker who pre-creates a link can't redirect the write. The framework's own predictable-temp and symlink-following write sites now route through them; fdSafeReadSync also gains a withStat option that returns the bound fd's stat alongside the bytes."
+        },
+        {
+          "title": "b.safeJson.stringifyForScript(value, opts?)",
+          "body": "A JSON serializer safe to embed directly in an inline <script> block: it escapes <, >, and & and the U+2028 / U+2029 line separators so a value containing </script> or a JS line terminator cannot break out of the script context (DOM-XSS). The import-map helper gains scriptTag(importMap, { nonce }) built on it, and the speculation-rules inline emitter uses it."
+        },
+        {
+          "title": "HTTP-client bandwidth throttling",
+          "body": "b.httpClient requests accept a bandwidth limit that interposes a throttling transform on both the download and upload paths, so a large transfer can be rate-shaped without buffering the whole body. Useful for bounding the egress a single outbound call can consume."
+        },
+        {
+          "title": "Incremental audit-chain verification",
+          "body": "The audit verifiers accept a from/to range so a long chain can be verified in increments rather than head-to-tail every time, report an accurate rowsVerified count, and keep the newest review when reconciling. b.vault also exposes getDefaultStore() for callers that need the process's default seal/unseal store handle."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Request-IP trust is peer-gated end to end",
+          "body": "The client-IP resolution that every IP gate depends on is extracted into one trust model (a trustedProxies-aware, peer-gated right-to-left walk) so the network allowlist, rate limiter, break-glass pin, and bot-guard audit attribution all decide identity the same way. X-Forwarded-Proto is peer-gated across the security middleware on the same model, and a WebSocket reconnect to a swapped target is re-validated against the SSRF / blocked-host guard before the connection is reused. See Migration for the one behavior change."
+        },
+        {
+          "title": "Authentication and signature verifiers fail closed",
+          "body": "A set of verifiers that could accept a malformed or unsigned credential now refuse it: SAML verifyResponse fails closed on a missing AudienceRestriction or unparseable Conditions; the FDA 21 CFR 11 electronic-signature verify refuses a record with no signature (recordHash alone is self-consistency, not authentication); the SD-JWT key-binding JWT requires an audience and nonce (replay binding) and an expiry when configured; DPoP cross-checks the proof's alg against its embedded JWK key type before importing it; CIBA verifies the ID token on poll and notification; the mdoc trust anchor is enforced (no fail-open); COSE binds the signature algorithm to the key curve; and agent-snapshot refuses allowPlaintext under a regulated compliance posture and gates sealing on vault initialization."
+        },
+        {
+          "title": "Pre-auth parsers hardened against complexity and frame-desync denial of service",
+          "body": "Parsers an attacker reaches before any credential check are bounded. CBOR rejects the quadratic-time duplicate-map-key construction (it ran O(n^2) on every COSE / CWT / EAT / mdoc verify) and rejects non-minimal integer/key encodings in canonical mode; JSONPath caps the node-list cross-product that could exhaust memory and rejects the filter expression that could overflow the parser stack; the tar reader caps a random-access entry read and resynchronizes a PAX header whose size field is non-numeric; the gzip reader caps a random-access output size; the YAML scanner replaces a backtracking pattern with a linear scan; the ASN.1 DER reader caps high-tag-number and OID sub-identifier decoding and rejects non-minimal forms; and the scheduler clamps far-future timers so a 32-bit overflow can't make a timer fire immediately or an interval tight-loop."
+        },
+        {
+          "title": "Allowlist and posture lookups keyed by untrusted input can't reach the prototype",
+          "body": "Lookups of the form map[untrustedKey] across the framework's allowlist and compliance-posture tables are now own-property checks, so a key like __proto__ or constructor resolves as absent instead of returning an inherited value and walking the gate (CWE-1321). The shared posture-accessor that several guards built by hand is centralized, and an inverse detector flags any re-introduced unguarded indexed lookup."
+        },
+        {
+          "title": "Framework file writes are symlink-refusing and atomic",
+          "body": "The predictable-temp and symlink-following write sites (cookie jar, config-drift snapshot, archive extraction, local object store, backup bundle, and the vault passphrase seal/unseal/rotate) now write through the atomic-write primitives above, so a pre-planted symlink at the destination or temp path can no longer redirect a privileged write, and a partial write can't leave a torn file. A re-introduced raw write without the exclusive/no-follow flags is flagged by a detector."
+        },
+        {
+          "title": "X.509 issuer chains enforce the CA basic constraint",
+          "body": "Node's checkIssued() does not verify that the issuer certificate is actually a CA (CVE-2002-0862 class), so a leaf signed by a non-CA certificate could be accepted as an issuer. Certificate-chain walking is centralized in one helper that requires the issuer's basicConstraints cA bit and verifies the signature, and every chain consumer (TSA, BIMI, S/MIME, mdoc, content-credentials, the FIDO MDS3 anchor match) routes through it."
+        },
+        {
+          "title": "Header, value, and markup injection closed",
+          "body": "Mail rejects CRLF in Reply-To and in custom header keys/values (SMTP header injection); the GDPR data-export CSV writer neutralizes formula-injection prefixes; the content guards decode no-semicolon numeric HTML entities when revealing a dangerous URL scheme (so &#106;avascript: is caught); the early-hints emitter rejects CRLF in pushed link values; the HTML/SVG/BIMI comment scanners honor the WHATWG abrupt-comment-close forms (--!>, <!-->) so a mutation-XSS comment can't smuggle markup; and the CSP builder no longer emits a host source alongside 'none'."
+        },
+        {
+          "title": "At-rest and egress data is bound to its context",
+          "body": "Backup restore binds each encrypted file blob to its manifest path as additional authenticated data, so a blob remapped to another entry fails the AEAD tag on restore (signed and unsigned bundles alike), and threads the signature-verification options through extraction; the data-subject-request lookup dual-reads the keyed and legacy subject hashes so a subject is still found across the hashing change (GDPR Art. 17); the log redactor collapses a secret nested as an array or object value, not only as a scalar; and the OTLP exporter redacts the span name and status message, not just attributes, before they leave the process."
+        },
+        {
+          "title": "Network-protocol verification hardened",
+          "body": "OCSP responses are bound to the requested certificate serial; the WebSocket reader rejects reserved opcodes and reserved bits; the DNS parser refuses a record that reads past the message buffer; the NTP client rejects a reply whose origin timestamp does not echo the request (and the SNTP cookie path was reworked to bind the exchange); DANE TLSA matching is constant-time; and MTA-STS policy fetch fails closed rather than degrading to no-policy on an ambiguous response."
+        },
+        {
+          "title": "Byte caps are measured in bytes, and middleware enforcement is per-instance",
+          "body": "Size limits that compared a byte budget against a string's character length (so multibyte input slipped a ~2-4x looser bound) now measure actual bytes — guard-json per-string cap, the per-tenant quota header budget, the JMAP request cap. The CSRF and fetch-metadata middleware track their gate per instance, so mounting a second, stricter instance still enforces (a shared request flag previously let the first, lenient mount disable it); the CSRF cookie is still issued once per response. The WebAssembly global is stripped from the sandbox worker so sandboxed code cannot JIT around the isolation."
+        },
+        {
+          "title": "Lost-update races serialized",
+          "body": "Concurrent failure recording in the login lockout and bot-challenge gates is serialized per key, so parallel failed attempts can no longer each read the same pre-write counter and stay under the lockout / challenge threshold. The inline webhook delivery is claimed before the POST so a concurrent retry pass can't double-send it, and a transient transport failure now backs off and retries instead of being dead-lettered."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "DORA major-incident reporting clock is four hours",
+          "body": "The Digital Operational Resilience Act initial-notification deadline is corrected to four hours from classification (it had used the generic 24-hour default), incident classification weighs the affected-client-base percentage, and the deadline anchors to the prior filing where one exists."
+        },
+        {
+          "title": "Range and conditional-request correctness",
+          "body": "Compression skips a 206 Partial Content or any Content-Range response (RFC 7233 §4.1), so it can't drop Content-Length over a now-compressed byte interval; static-file conditional handling gives If-None-Match precedence over If-Modified-Since and If-Match over If-Unmodified-Since (RFC 7232); and the object store honors the [start, end] array range contract that previously fell through to a full read."
+        },
+        {
+          "title": "Declared request bodies are always validated",
+          "body": "A route that declares a body schema now validates it even when no body was parsed, so an omitted required body is rejected at the router instead of reaching the handler — mirroring the always-run params and query checks."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Object store getStream works on remote backends",
+          "body": "getStream() returned a stream wrapping an unresolved promise on every remote backend, so it never delivered bytes; it now resolves the object before streaming."
+        },
+        {
+          "title": "Queue and body-parser correctness",
+          "body": "The local queue's fail()/complete() paths guard on the current row status so a stale lease can't resurrect or double-process a job, and the body parser's raw() mode no longer matches every content type by default (it had answered 415 to nothing or everything depending on the wildcard)."
+        },
+        {
+          "title": "Sanctions screening and GraphQL SDL probing no longer under-match",
+          "body": "Sanctions screening no longer skips a candidate whose type doesn't match the query's type filter (a sanctioned entity of an unspecified type was missed) and reports a typeMatch flag; the GraphQL federation guard probes for the _service / _entities introspection fields by word boundary (an aliased field bypassed the prefix check) and over batched-array request bodies. The per-tenant query budget is a true sliding window, so a burst straddling the window boundary can't briefly double the rate."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/check-vendor-currency.js

@@ -51,7 +51,27 @@ var TIMEOUT_MS     = 10000;
 //   { type: "npm-meta", components: [...] }    — meta-bundle: each component must be current
 //   { type: "github-raw", note: "..." }        — GitHub raw download (no version semantics)
 //   { type: "skip", reason: "..." }            — skip with documented reason
+//   { type: "http-content", url, localFile, commitRe?, versionRe? }
+//                                              — data file tracked off a
+//                                                bare upstream URL (no
+//                                                version semantics); compare
+//                                                an embedded COMMIT/VERSION
 var SPECIAL_MAP = {
+  "publicsuffix-list": {
+    type: "http-content",
+    url: "https://publicsuffix.org/list/public_suffix_list.dat",
+    localFile: "public-suffix-list.dat",
+    // The PSL embeds an immutable git COMMIT sha and a VERSION timestamp
+    // in its header; either changes iff the list changed. Comparing them
+    // is robust to our appended canary block — a plain content hash is
+    // not (the canary makes our copy hash differ from upstream forever).
+    commitRe:  /^\/\/ COMMIT:\s*([0-9a-f]{7,40})/m,
+    versionRe: /^\/\/ VERSION:\s*(\S+)/m
+  },
+  "bimi-trust-anchors": {
+    type: "skip",
+    reason: "operator-managed VMC/CMC trust anchors — empty source-tree default by design; operators populate + refresh per the file-header procedure, so there is no single upstream version to track"
+  },
   "SecLists-common-passwords-top-10000": {
     type: "github-master",
     owner: "danielmiessler",
@@ -138,6 +158,66 @@ function _registryFetch(name) {
   });
 }
 
+function _httpGetText(url, redirectsLeft) {
+  // Plain text GET that follows redirects (publicsuffix.org has issued
+  // 30x to a CDN host in the past). Same node:https rationale as
+  // _registryFetch — the gate runs before any framework state exists.
+  if (redirectsLeft === undefined) redirectsLeft = 5;
+  return new Promise(function (resolve, reject) {
+    var req = https.get(url, { timeout: TIMEOUT_MS,
+      headers: { "User-Agent": "blamejs-vendor-currency/1", "Accept": "text/plain,*/*" }
+    }, function (res) {
+      var sc = res.statusCode;
+      if (sc >= 300 && sc < 400 && res.headers.location) {
+        res.resume();
+        if (redirectsLeft <= 0) return reject(new Error("too many redirects for " + url));
+        var next;
+        try { next = new URL(res.headers.location, url).toString(); }
+        catch (e) { return reject(e); }
+        return resolve(_httpGetText(next, redirectsLeft - 1));
+      }
+      if (sc !== 200) {
+        res.resume();
+        return reject(new Error("GET " + url + " status " + sc));
+      }
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () { resolve(Buffer.concat(chunks).toString("utf8")); });
+    });
+    req.on("timeout", function () { req.destroy(new Error("GET " + url + " timed out after " + TIMEOUT_MS + "ms")); });
+    req.on("error", reject);
+  });
+}
+
+// Pure comparison for content-tracked data-file vendors (no semver,
+// no npm registry). Extracted so it is unit-testable without network:
+// feed it the upstream + local file text and the SPECIAL_MAP entry.
+//
+// Primary signal is an immutable upstream identifier embedded in the
+// file (the PSL ships `// COMMIT: <sha>`); the fallback is a version/
+// timestamp header (`// VERSION: <ts>`). Both survive our appended
+// canary block and trailing-whitespace churn — they change iff the
+// upstream data changed. Returns { stale, basis, upstreamId, localId }
+// or throws when neither side yields a comparable identifier (the
+// caller maps that to "registry-error" so an upstream-format change
+// surfaces loudly instead of silently passing the gate).
+function _classifyContentCurrency(upstreamText, localText, special) {
+  function pick(text, re) { var m = re && text.match(re); return (m && m[1]) || null; }
+  var uCommit = pick(upstreamText, special.commitRe);
+  var lCommit = pick(localText,    special.commitRe);
+  var uVer    = pick(upstreamText, special.versionRe);
+  var lVer    = pick(localText,    special.versionRe);
+  if (uCommit && lCommit) {
+    return { stale: uCommit !== lCommit, basis: "commit", upstreamId: uCommit, localId: lCommit,
+             upstreamVersion: uVer, localVersion: lVer };
+  }
+  if (uVer && lVer) {
+    return { stale: uVer !== lVer, basis: "version", upstreamId: uVer, localId: lVer,
+             upstreamVersion: uVer, localVersion: lVer };
+  }
+  throw new Error("no comparable COMMIT/VERSION identifier in upstream or local copy");
+}
+
 function _semverParse(v) {
   // Strip leading "v" + any pre-release tail. Returns [maj, min, pat]
   // as numbers, or null if not parseable.
@@ -197,6 +277,30 @@ async function _checkOne(key, manifestEntry) {
       };
     }
   }
+  if (special && special.type === "http-content") {
+    // Data file tracked off a bare upstream URL (e.g. the PSL). Fetch
+    // upstream, read our bundled copy, compare embedded COMMIT/VERSION.
+    try {
+      var upstreamText = await _httpGetText(special.url);
+      var localPath = path.join(__dirname, "..", "lib", "vendor", special.localFile);
+      var localText = fs.readFileSync(localPath, "utf8");
+      var verdict = _classifyContentCurrency(upstreamText, localText, special);
+      return {
+        key:        key,
+        upstream:   special.url,
+        bundledAt:  verdict.localVersion || verdict.localId,
+        upstreamAt: verdict.upstreamVersion || verdict.upstreamId,
+        basis:      verdict.basis,
+        status:     verdict.stale ? "stale" : "current",
+      };
+    } catch (e) {
+      return {
+        key:    key,
+        status: "registry-error",
+        error:  (e && e.message) || String(e),
+      };
+    }
+  }
   if (special && special.type === "npm-meta") {
     // Check each component independently. Aggregate results.
     var componentResults = [];
@@ -343,7 +447,18 @@ async function main() {
   process.exit(0);
 }
 
-main().catch(function (e) {
-  process.stderr.write("[vendor-currency] script crashed: " + (e && e.stack || e) + "\n");
-  process.exit(2);
-});
+// Exported for hermetic unit tests (the content-currency classifier is
+// pure — no network — and is the load-bearing logic for PSL drift).
+module.exports = {
+  _classifyContentCurrency: _classifyContentCurrency,
+  _semverParse: _semverParse,
+  _semverCompare: _semverCompare,
+  SPECIAL_MAP: SPECIAL_MAP,
+};
+
+if (require.main === module) {
+  main().catch(function (e) {
+    process.stderr.write("[vendor-currency] script crashed: " + (e && e.stack || e) + "\n");
+    process.exit(2);
+  });
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -5876,6 +5876,7 @@ async function testBackupBundleCreateEndToEnd() {
     check("emitted manifest is parse-valid",        m.version === 1);
     check("manifest has 4 file entries",            m.files.length === 4);
     check("manifest carries operator metadata",     m.metadata && m.metadata.reason === "test-end-to-end");
+    check("manifest marks blobs AEAD path-bound",   m.aadBound === true);
 
     // Vault key round-trip — decrypt with passphrase + bundled salt
     var vkBytes = await b.backupCrypto.decryptWithPassphrase(
@@ -5891,7 +5892,10 @@ async function testBackupBundleCreateEndToEnd() {
       var blob = fs.readFileSync(blobPath);
       check("blob size matches manifest.encryptedSize for " + entry.relativePath,
             blob.length === entry.encryptedSize);
-      var dec = await b.backupCrypto.decryptWithPassphrase(blob, passphrase, entry.salt);
+      // Blobs are sealed with their relativePath as AEAD associated data
+      // (manifest.aadBound) — pass it so the manual decrypt matches.
+      var blobAad = m.aadBound === true ? entry.relativePath : undefined;
+      var dec = await b.backupCrypto.decryptWithPassphrase(blob, passphrase, entry.salt, blobAad);
       var origPath = path.join(fx.dataDir, entry.relativePath);
       var orig = fs.readFileSync(origPath);
       check("decrypted blob matches original plaintext for " + entry.relativePath,

package/lib/vendor/blamejs/test/integration/mail-crypto-smime.test.js

@@ -52,11 +52,14 @@ function _x509GeneralizedTime(d) {
 }
 function _buildMlDsaCert(opts) {
   // opts: { subjectCn, subjectPubKey, issuerCn, issuerSecretKey, serial,
-  //         notBefore, notAfter }. signatureAlgorithm == subject key alg
-  // (ML-DSA-65) for both self-signed (CA) and issued (leaf) shapes.
+  //         notBefore, notAfter, isCa }. signatureAlgorithm == subject key
+  // alg (ML-DSA-65) for both self-signed (CA) and issued (leaf) shapes.
+  // isCa: true emits a critical basicConstraints cA:TRUE extension so the
+  // cert is accepted as a chain issuer (a CA cert without it is rejected
+  // by the cA-enforcing chain walk — RFC 5280 §4.2.1.9 / CVE-2002-0862).
   var algId = asn1.writeSequence([asn1.writeOid(cms.OID.mldsa65)]);
   var spki  = asn1.writeSequence([algId, asn1.writeBitString(Buffer.from(opts.subjectPubKey), 0)]);
-  var tbs = asn1.writeSequence([
+  var tbsFields = [
     asn1.writeContextExplicit(0, asn1.writeInteger(Buffer.from([2]))),   // version v3
     asn1.writeInteger(Buffer.from([opts.serial])),                       // serialNumber
     algId,                                                               // signature AlgorithmIdentifier
@@ -65,7 +68,17 @@ function _buildMlDsaCert(opts) {
                         _x509GeneralizedTime(opts.notAfter)]),           // validity
     _x509Name(opts.subjectCn),                                           // subject
     spki,                                                                // SubjectPublicKeyInfo
-  ]);
+  ];
+  if (opts.isCa) {
+    var bcValue = asn1.writeSequence([asn1.writeBoolean(true)]);         // BasicConstraints { cA TRUE }
+    var bcExt = asn1.writeSequence([
+      asn1.writeOid("2.5.29.19"),                                        // basicConstraints
+      asn1.writeBoolean(true),                                           // critical
+      asn1.writeOctetString(Buffer.from(bcValue)),                       // extnValue
+    ]);
+    tbsFields.push(asn1.writeContextExplicit(3, asn1.writeSequence([bcExt]))); // [3] EXPLICIT Extensions
+  }
+  var tbs = asn1.writeSequence(tbsFields);
   var sig = b.pqcSoftware.ml_dsa_65.sign(new Uint8Array(tbs), opts.issuerSecretKey);
   return asn1.writeSequence([tbs, algId, asn1.writeBitString(Buffer.from(sig), 0)]);
 }
@@ -195,6 +208,7 @@ async function run() {
       serial:         1,
       notBefore:      notBefore,
       notAfter:       notAfter,
+      isCa:           true,                                               // trust anchor must assert cA:TRUE
     });
     var pqcLeafCertDer = _buildMlDsaCert({
       subjectCn:      "smime-signer.blamejs-test.example",