@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/.clusterfuzzlite/Dockerfile

@@ -1,21 +1,32 @@
-# ClusterFuzzLite build image for blamejs.
+# ClusterFuzzLite / OSS-Fuzz build image for blamejs.
 #
-# Inherits from oss-fuzz's JavaScript base-builder (jazzer.js +
-# libFuzzer + the compile_javascript_fuzzer helper pre-installed).
-# Copy the framework source + harnesses, then build.sh wires each
-# fuzz target into a libFuzzer-shaped runnable.
+# Inherits libFuzzer + the compile_javascript_fuzzer helper from oss-fuzz's
+# JavaScript base-builder. jazzer.js is NOT in the base image — build.sh installs
+# @jazzer.js/core (pinned in fuzz/package.json) into the project-root node_modules
+# so the runnable compile_javascript_fuzzer emits can resolve it at fuzz time.
+# Copy the framework source + harnesses, then build.sh wires each fuzz target
+# into a libFuzzer-shaped runnable.
 #
-# ClusterFuzzLite consumes this same Dockerfile for the PR + batch
-# fuzz workflows (`.github/workflows/cflite_*.yml`). OSS-Fuzz upstream
-# uses the project-specific Dockerfile under `oss-fuzz/projects/blamejs/`
-# which mirrors this shape — keep them in sync.
+# This image is the OSS-Fuzz-upstream integration spec — OSS-Fuzz's own
+# oss-fuzz/projects/blamejs/ Dockerfile + build.sh mirror this shape; keep them
+# in sync. The in-repo CI fuzz workflows (.github/workflows/cflite_*.yml) do NOT
+# use this image — they invoke jazzer.js directly on ubuntu-latest (the CFLite
+# build_fuzzers wrapper is broken for JS as of 2026; see cflite_pr.yml).
+#
+# NOTE — the upstream path is currently LATENT and cannot execute targets: the
+# base-builder-javascript image ships Node 20 + GLIBC 2.31, but blamejs needs
+# Node 22+ (node:sqlite; engine floor 24.18) and @jazzer.js/core needs GLIBC 2.38.
+# build.sh is correct and forward-compatible — it re-engages unchanged once
+# OSS-Fuzz ships a Node 24 / Ubuntu 24.04 base-builder-javascript. Do NOT downgrade
+# @jazzer.js/core to "fix" this: the Node-20 floor blocks blamejs regardless, and a
+# downgrade only risks the working CI (which runs Node 24 on ubuntu-latest).
 #
 # The base is digest-pinned for a reproducible CI fuzz toolchain (Dependabot
 # bumps it via the docker ecosystem entry for /.clusterfuzzlite). Note: the
 # oss-fuzz/projects/blamejs/ copy is intentionally left on the floating tag —
 # OSS-Fuzz's own build infra expects projects to track the latest base-builder,
 # so pinning there would diverge from upstream convention.
-FROM gcr.io/oss-fuzz-base/base-builder-javascript@sha256:990a7eb71a3001c3df3ae3b528e3797442d8666592ee24f86d4ce13b231db968
+FROM gcr.io/oss-fuzz-base/base-builder-javascript@sha256:649105c8df1de6b5e752aaad2c944198aba5cb79481b9ccbcaa189854d9f50d2
 
 # Copy the framework source. ClusterFuzzLite mounts the repo at
 # $SRC/blamejs, so we COPY everything (including fuzz/) into one

package/lib/vendor/blamejs/.clusterfuzzlite/build.sh

@@ -14,20 +14,41 @@
 
 cd "$SRC/blamejs"
 
-# Stage every harness into $OUT/<base>. compile_javascript_fuzzer
-# resolves the module via Node's normal resolution from the repo
-# root, so `require("..")` in each harness picks up the framework
-# entry-point.
+# Install the fuzz-time runtime (@jazzer.js/core) before compiling. The
+# base-builder-javascript image ships jazzer.js for the compile helper, but the
+# runnable it emits execs `<project>/node_modules/@jazzer.js/core/dist/cli.js` at
+# fuzz time: compile_javascript_fuzzer copies $SRC/blamejs -> $OUT/blamejs
+# wholesale, so the runtime must already be present in the PROJECT-ROOT
+# node_modules. @jazzer.js/core is pinned in fuzz/package.json (kept out of the
+# framework's own manifest, which ships zero runtime deps), so install it there
+# and surface it at the project root. Skipping this leaves every target pointing
+# at a runtime that isn't present; the compile step still exits 0, so the gap is
+# otherwise silent — the targets build but cannot start.
+npm ci --prefix fuzz
+mkdir -p node_modules
+cp -r fuzz/node_modules/. node_modules/
+
+# Stage every harness into $OUT. compile_javascript_fuzzer resolves the module
+# via Node's normal resolution from the repo root, so `require("..")` in each
+# harness picks up the framework entry-point.
 for fuzzer in fuzz/*.fuzz.js; do
-  base=$(basename "$fuzzer" .fuzz.js)
-  echo "[blamejs build] compiling $base"
+  # compile_javascript_fuzzer names the target `basename -s .js`, so
+  # `fuzz/guard-csv.fuzz.js` builds the artifact `guard-csv.fuzz`. The seed
+  # corpus is paired by that exact target name (`<target>_seed_corpus.zip`),
+  # while the seed-corpus SOURCE dir drops `.fuzz.js` (`fuzz/<base>_seed_corpus`).
+  # Using <base> for the zip (as this script once did) names it
+  # `guard-csv_seed_corpus.zip`, which never pairs with `guard-csv.fuzz` — so the
+  # engine silently bootstraps from an empty corpus.
+  target=$(basename "$fuzzer" .js)        # guard-csv.fuzz — matches the built artifact
+  base=$(basename "$fuzzer" .fuzz.js)     # guard-csv      — matches the seed-corpus dir
+  echo "[blamejs build] compiling $target"
   compile_javascript_fuzzer blamejs "$fuzzer" --sync
 
-  # Zip the seed corpus if it exists.
+  # Zip the seed corpus if it exists, under the target's name so it pairs.
   seed_dir="fuzz/${base}_seed_corpus"
   if [ -d "$seed_dir" ]; then
-    echo "[blamejs build] packaging seed corpus for $base"
-    ( cd "$seed_dir" && zip -q -r "$OUT/${base}_seed_corpus.zip" . )
+    echo "[blamejs build] packaging seed corpus for $target"
+    ( cd "$seed_dir" && zip -q -r "$OUT/${target}_seed_corpus.zip" . )
   fi
 done
 

package/lib/vendor/blamejs/.github/dependabot.yml

@@ -8,6 +8,14 @@ updates:
     labels:
       - "deps"
       - "github-actions"
+    # codeql-action ships init / analyze / upload-sarif from one repo at one
+    # version. Split PRs leave the workflows on mixed versions, which the
+    # actions-currency gate refuses and the CodeQL bundle rejects at run
+    # time — group them so every bump arrives as a single coherent PR.
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
 
   - package-ecosystem: "npm"
     directory: "/examples/wiki"

package/lib/vendor/blamejs/.github/workflows/actions-lint.yml

@@ -49,7 +49,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -110,7 +110,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -152,7 +152,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 

package/lib/vendor/blamejs/.github/workflows/cflite_batch.yml

@@ -66,14 +66,19 @@ jobs:
           - guard-posture-chain
           - guard-trace-context
           - guard-snapshot-envelope
+          # Untrusted-byte parsers not named safe-*/guard-* (asn1-der feeds every
+          # certificate path: peer TLS, S/MIME, BIMI, CMS, ACME, TSA).
+          - asn1-der
+          - cms-codec
+          - link-header
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24'
 

package/lib/vendor/blamejs/.github/workflows/cflite_pr.yml

@@ -77,14 +77,19 @@ jobs:
           - guard-trace-context
           - guard-snapshot-envelope
           - safe-smtp
+          # Untrusted-byte parsers not named safe-*/guard-* (asn1-der feeds every
+          # certificate path: peer TLS, S/MIME, BIMI, CMS, ACME, TSA).
+          - asn1-der
+          - cms-codec
+          - link-header
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24'
 

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -53,12 +53,12 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -140,12 +140,12 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -162,12 +162,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -187,11 +187,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: 24.18.0
       - name: Run vendor-currency check
@@ -212,11 +212,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: 24.18.0
       - name: Run actions-currency check
@@ -241,7 +241,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           # gitleaks scans full history on a non-shallow checkout, so an
@@ -300,12 +300,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -356,7 +356,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -394,7 +394,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -433,12 +433,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -464,12 +464,12 @@ jobs:
       output:  ${{ steps.eslint.outputs.output }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -506,7 +506,7 @@ jobs:
       output:  ${{ steps.hadolint_result.outputs.output }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -550,7 +550,7 @@ jobs:
       output:  ${{ steps.shellcheck.outputs.output }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 

package/lib/vendor/blamejs/.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -32,7 +32,7 @@ jobs:
       # hop); the language ID picks up the .js files under lib/ +
       # scripts/ regardless.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
         with:
           languages: javascript-typescript
           # Scope (paths) + query suite (security-extended) live in the config
@@ -46,6 +46,6 @@ jobs:
       # Auto-build is skipped because CommonJS files don't need a build
       # step; CodeQL extracts straight from source.
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
         with:
           category: "/language:javascript-typescript"

package/lib/vendor/blamejs/.github/workflows/npm-publish.yml

@@ -95,12 +95,12 @@ jobs:
       hashes:  ${{ steps.subjects.outputs.hashes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
 
@@ -390,7 +390,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Set up Node 24.18.0 LTS + npm registry auth
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
           registry-url: 'https://registry.npmjs.org'
@@ -460,7 +460,7 @@ jobs:
         # `node src/scripts/*` step — earlier ordering meant the
         # signer step ran against a non-existent `src/` directory
         # and failed immediately on the first PQC release run.
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: src

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -56,11 +56,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Node 24.18.0 LTS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '24.18.0'
       - name: Run ESLint (max-warnings 0)
@@ -74,7 +74,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Run Hadolint (strict, all severities)
@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Detect shell scripts
@@ -123,7 +123,7 @@ jobs:
       version: ${{ steps.tags.outputs.semver }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -135,7 +135,7 @@ jobs:
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -340,7 +340,7 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

package/lib/vendor/blamejs/.github/workflows/scorecard.yml

@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc  # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -40,7 +40,7 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
         with:
           sarif_file: results.sarif
 

package/lib/vendor/blamejs/.github/workflows/sha-to-tag-verify.yml

@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout (full history needed for first-parent walk)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0

package/lib/vendor/blamejs/.gitignore

@@ -34,6 +34,8 @@ coverage/
 *.pid.lock
 *.seed
 tmp/
+# vendor-update.sh --refresh-data in-flight downloads (never shippable)
+*.refresh-tmp
 
 # OS junk (non-dotfile)
 Thumbs.db