@blamejs/blamejs-shop 0.4.89 → 0.4.90

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.19",
+  "version": "0.15.20",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.20.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.20",
+  "date": "2026-06-24",
+  "headline": "Vendored SBOM version fields are derived from the bundle so they cannot drift, and the Public Suffix List + @simplewebauthn/server bundles are refreshed",
+  "summary": "The vendor manifest recorded each bundled package's version in two scanner-facing places that were hand-maintained and could drift from the code actually shipped — the structured components[].version (the CycloneDX component versions) and the cpe string. Two had drifted: peculiar-pki's @peculiar/x509 component read 1.13.0 while the bundle shipped 2.0.0, and @noble/curves' cpe read 0.0.0 while the bundle shipped 2.2.0. A CVE scanner (Trivy / Grype / a CycloneDX export, or a consumer mirroring the manifest into its own SBOM) keys on those structured fields, so an advisory was matched against the wrong version — a false negative on a real fix or a false positive on a patched one. Both fields are corrected, the vendor-bundle script now derives them from the actually-installed package versions at bundle time so they cannot drift again, and a manifest gate fails the build if they ever disagree. Separately, the vendored Mozilla Public Suffix List is refreshed to the current upstream revision and @simplewebauthn/server is refreshed to 13.3.2.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Vendored SBOM version metadata is bundle-derived, not hand-maintained",
+          "body": "lib/vendor/MANIFEST.json recorded each package's version in two places a CVE/SBOM scanner reads — the structured components[].version sub-object and the cpe string — both hand-maintained alongside the human version string, so they could (and did) drift from the bundled code. @peculiar/x509's component version read 1.13.0 while the bundle shipped 2.0.0; @noble/curves' cpe read 0.0.0 while the bundle shipped 2.2.0. Either drift makes a scanner match advisories against the wrong version. Both are corrected to the shipped versions, and the durable fix is structural: scripts/vendor-update.sh now writes both the structured component versions and the cpe version from the ACTUALLY-INSTALLED package versions captured at bundle time, so a maintainer can no longer update one field and forget the other. A smoke-time manifest gate additionally fails the build if any component or cpe version disagrees with the package version, catching a manual drift before it ships."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Vendored Public Suffix List and @simplewebauthn/server refreshed",
+          "body": "The vendored Mozilla Public Suffix List is refreshed to the current upstream revision (used by b.publicSuffix for DMARC / BIMI / cookie-scope / same-site domain classification). @simplewebauthn/server is refreshed from 13.3.1 to 13.3.2, which improves WebAuthn attestation certificate-path validation; the published-tarball diff was reviewed (no install scripts, no network/eval, a self-contained code change) before re-vendoring."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/vendor-update.sh

@@ -203,6 +203,12 @@ ENTRY
     rm _pki-entry.mjs
     sed -i "1s|^|// Peculiar PKI — vendored @peculiar/x509 v${X509_VER} + pkijs v${PKIJS_VER}\n// License: MIT. Bundled with esbuild.\n// Exports: { pkijs, x509, crypto (node:webcrypto bound) }\n// Includes: reflect-metadata, pvutils, pvtsutils, asn1js, @peculiar/asn1-*\n// Used by lib/mtls-engine-default.js for pure-JS CA + PKCS#12 operations.\n|" lib/vendor/pki.cjs
     INSTALLED_VER="${X509_VER}+pkijs-${PKIJS_VER}"
+    # Structured SBOM component versions, derived from the ACTUALLY-INSTALLED
+    # package versions captured above — written into MANIFEST components[] below
+    # so the sub-object the CVE scanners key on can never drift from the bundle
+    # (issue #366). A scanner-facing fact must come from the install, not a hand
+    # edit.
+    COMPONENT_VERSIONS_JSON="{\"@peculiar/x509\":\"${X509_VER}\",\"pkijs\":\"${PKIJS_VER}\"}"
     ;;
 
   *)
@@ -213,14 +219,35 @@ ENTRY
     ;;
 esac
 
-# Update MANIFEST.json
-node -e "
+# Update MANIFEST.json. COMPONENT_VERSIONS_JSON (set only for meta-bundles that
+# carry a structured components[] sub-object, e.g. peculiar-pki) is passed via
+# the environment so its JSON braces/quotes don't fight the bash interpolation
+# into the inline node script.
+COMPONENT_VERSIONS_JSON="${COMPONENT_VERSIONS_JSON:-}" node -e "
 var fs = require('fs');
 var m = JSON.parse(fs.readFileSync('$MANIFEST', 'utf8'));
 var pkg = '$PKG';
 if (m.packages[pkg]) {
   m.packages[pkg].version = '$INSTALLED_VER';
   m.packages[pkg].bundledAt = '$DATE';
+  // Derive structured SBOM component versions from the ACTUALLY-INSTALLED
+  // packages (issue #366) so components[].version — the field CycloneDX / Trivy
+  // / Grype key on — can never drift from the bundled version string.
+  var compJson = process.env.COMPONENT_VERSIONS_JSON || '';
+  if (compJson && m.packages[pkg].components) {
+    var comps = JSON.parse(compJson);
+    Object.keys(comps).forEach(function (c) {
+      if (m.packages[pkg].components[c]) { m.packages[pkg].components[c].version = comps[c]; }
+    });
+  }
+  // Keep the cpe version in sync with the install too — same SBOM-drift class
+  // as components[] (#366): the cpe string encodes the version in field 5
+  // (cpe:2.3:a:vendor:product:VERSION:...) and CVE scanners match against it.
+  if (typeof m.packages[pkg].cpe === 'string') {
+    var sv = (String('$INSTALLED_VER').match(/\d+\.\d+\.\d+/) || [null])[0];
+    var parts = m.packages[pkg].cpe.split(':');
+    if (sv && parts.length > 5) { parts[5] = sv; m.packages[pkg].cpe = parts.join(':'); }
+  }
   fs.writeFileSync('$MANIFEST', JSON.stringify(m, null, 2) + '\n');
   console.log('Updated MANIFEST.json: ' + pkg + ' -> ' + '$INSTALLED_VER');
 } else {

package/lib/vendor/blamejs/test/layer-0-primitives/vendor-manifest.test.js

@@ -79,6 +79,52 @@ function run() {
       check("vendor manifest: " + name + " :: " + fk + " hash matches",
             declared[fk] === actual[fk]);
     }
+
+    // SBOM / CVE scanners (Trivy / Grype / a CycloneDX export) key on the
+    // STRUCTURED components[<pkg>].version, not the human version string. A
+    // hand-maintained components sub-object can drift from the version string
+    // (#366: the bundle moved @peculiar/x509 1.13.0 -> 2.0.0, the version
+    // string was updated to 2.0.0 but components still read 1.13.0, so any
+    // advisory in the (1.13.0, 2.0.0] range matched the wrong version). Nothing
+    // auto-derives components (refresh-vendor-manifest only refreshes hashes),
+    // so gate the consistency here: every structured component version MUST
+    // appear in the package's version string, making the drift un-shippable.
+    if (pkg.components && typeof pkg.version === "string") {
+      // Bind the structured component versions to the version string as a
+      // MULTISET, not a loose substring: the sorted list of component versions
+      // must equal the sorted list of semver tokens in the version string. A
+      // bare "does the component version appear in the string" check would let
+      // a component drift to a value that merely appears elsewhere in the string
+      // — e.g. setting @peculiar/x509 to pkijs's 3.4.0 passes indexOf against
+      // "2.0.0+pkijs-3.4.0" but the SBOM then reports the wrong x509 version.
+      // The multiset {3.4.0,3.4.0} != {2.0.0,3.4.0} catches it.
+      var compVers = Object.keys(pkg.components)
+        .map(function (cn) { return pkg.components[cn] && pkg.components[cn].version; })
+        .filter(function (v) { return typeof v === "string"; })
+        .sort();
+      var strVers = (pkg.version.match(/\d+\.\d+\.\d+/g) || []).slice().sort();
+      check("vendor manifest: " + name + " :: components[] versions [" + compVers.join(",") +
+            "] are exactly the semver tokens in the version string [" + strVers.join(",") + "]",
+            compVers.length === strVers.length &&
+            compVers.every(function (v, i) { return v === strVers[i]; }));
+    }
+
+    // The cpe (Common Platform Enumeration) string encodes the version in
+    // field 5 (cpe:2.3:a:vendor:product:VERSION:...) and CVE scanners match
+    // against it — the same SBOM-drift class as components[] (#366 sibling:
+    // @noble/curves shipped 2.2.0 but its cpe still read 0.0.0). Gate it: the
+    // cpe version must equal the package's (leading) semver, so a wrong-version
+    // CVE match can't ship.
+    if (typeof pkg.cpe === "string") {
+      var cpeM = /^cpe:2\.3:a:[^:]+:[^:]+:([^:]+):/.exec(pkg.cpe);
+      var cpeVer = cpeM ? cpeM[1] : null;
+      var pkgSemver = (String(pkg.version).match(/\d+\.\d+\.\d+/) || [null])[0];
+      if (cpeVer !== null && cpeVer !== "*" && pkgSemver !== null) {
+        check("vendor manifest: " + name + " :: cpe version (" + cpeVer +
+              ") matches the package version (" + pkgSemver + ")",
+              cpeVer === pkgSemver);
+      }
+    }
   }
   check("vendor manifest: scanned at least one hash",
         totalHashes > 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.89",
+  "version": "0.4.90",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {