@blamejs/blamejs-shop 0.5.5 → 0.5.6

package/lib/vendor/blamejs/.clusterfuzzlite/Dockerfile

@@ -15,7 +15,7 @@
 # oss-fuzz/projects/blamejs/ copy is intentionally left on the floating tag —
 # OSS-Fuzz's own build infra expects projects to track the latest base-builder,
 # so pinning there would diverge from upstream convention.
-FROM gcr.io/oss-fuzz-base/base-builder-javascript@sha256:454290c335fd888ca5231b585d5674841f35bd38d0d2de40db64da83926c8b1a
+FROM gcr.io/oss-fuzz-base/base-builder-javascript@sha256:990a7eb71a3001c3df3ae3b528e3797442d8666592ee24f86d4ce13b231db968
 
 # Copy the framework source. ClusterFuzzLite mounts the repo at
 # $SRC/blamejs, so we COPY everything (including fuzz/) into one

package/lib/vendor/blamejs/.github/dependabot.yml

@@ -27,6 +27,15 @@ updates:
       - "deps"
       - "devdeps"
 
+  - package-ecosystem: "npm"
+    directory: "/fuzz"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "deps"
+      - "fuzz"
+
   - package-ecosystem: "docker"
     directory: "/examples/wiki"
     schedule:
@@ -37,8 +46,9 @@ updates:
       - "docker"
 
   # Keeps the digest-pinned oss-fuzz base-builder in .clusterfuzzlite/Dockerfile
-  # current (the oss-fuzz/projects/ submission copy is intentionally unpinned —
-  # it tracks upstream, see that file's header).
+  # current — the single tracked source. The oss-fuzz/projects/ submission copy
+  # now mirrors this same digest (scripts/pin-all.js syncs it; pin-all --check
+  # gates the two staying identical), so it needs no separate updater.
   - package-ecosystem: "docker"
     directory: "/.clusterfuzzlite"
     schedule:

package/lib/vendor/blamejs/.github/workflows/cflite_batch.yml

@@ -78,7 +78,7 @@ jobs:
           node-version: '24'
 
       - name: Install jazzer.js
-        run: npm install --no-save @jazzer.js/core@^2
+        run: npm ci --prefix fuzz
 
       - name: Fuzz ${{ matrix.target }}
         env:
@@ -89,10 +89,10 @@ jobs:
           corpus="fuzz/${{ matrix.target }}_seed_corpus"
           echo "::group::jazzer fuzz $harness ($FUZZ_TIME s)"
           if [ -d "$corpus" ]; then
-            npx --yes jazzer "$harness" "$corpus" -- \
+            npx --prefix fuzz jazzer "$harness" "$corpus" -- \
               -max_total_time="$FUZZ_TIME" -error_exitcode=1 -timeout=30
           else
-            npx --yes jazzer "$harness" -- \
+            npx --prefix fuzz jazzer "$harness" -- \
               -max_total_time="$FUZZ_TIME" -error_exitcode=1 -timeout=30
           fi
           echo "::endgroup::"

package/lib/vendor/blamejs/.github/workflows/cflite_pr.yml

@@ -89,7 +89,7 @@ jobs:
           node-version: '24'
 
       - name: Install jazzer.js
-        run: npm install --no-save @jazzer.js/core@^2
+        run: npm ci --prefix fuzz
 
       - name: Fuzz ${{ matrix.target }}
         env:
@@ -104,10 +104,10 @@ jobs:
           # Pass seed corpus as first positional arg when present;
           # libFuzzer treats directory args as corpus inputs.
           if [ -d "$corpus" ]; then
-            npx --yes jazzer "$harness" "$corpus" -- \
+            npx --prefix fuzz jazzer "$harness" "$corpus" -- \
               -max_total_time="$FUZZ_TIME" -error_exitcode=1 -timeout=30
           else
-            npx --yes jazzer "$harness" -- \
+            npx --prefix fuzz jazzer "$harness" -- \
               -max_total_time="$FUZZ_TIME" -error_exitcode=1 -timeout=30
           fi
           echo "::endgroup::"

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -57,10 +57,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Show Node + npm version
         run: node --version && npm --version
@@ -71,18 +71,16 @@ jobs:
         # present before the test runs. The framework still ships ZERO
         # runtime deps — devDependencies don't reach the npm tarball
         # per the `files` allowlist in package.json. `--no-audit
-        # --no-fund` keeps CI noise down; lockfile isn't committed so
-        # we resolve from package.json's exact-pinned versions.
+        # --no-fund` keeps CI noise down.
         #
-        # Each devDependency is installed by exact name@version (the
-        # same pins package.json carries) so CodeQL's PinnedDependencies
-        # query sees a version-pinned install rather than a bare
-        # `npm install` that resolves dynamically. blamejs deliberately
-        # does not commit a lockfile — the framework ships zero npm
-        # runtime deps (everything vendored under lib/vendor/) and each
-        # transpilation step is a supply-chain hop. The explicit
-        # name@version specifiers are the source-of-truth pin.
-        run: npm install --no-audit --no-fund --no-save esbuild@0.28.1 postject@1.0.0-alpha.6
+        # `npm ci` installs exactly the committed root package-lock.json,
+        # which pins esbuild + postject at the reviewed package.json
+        # devDependency versions with integrity hashes — so OpenSSF
+        # Scorecard's Pinned-Dependencies query sees a pinned install (it
+        # keys on the `ci` verb, not a name@version specifier). The
+        # framework still ships zero npm RUNTIME deps (everything vendored
+        # under lib/vendor/); the committed lockfile is dev-only.
+        run: npm ci --no-audit --no-fund
 
       - name: Run framework smoke
         # NODE_OPTIONS heap bump — codebase-patterns duplicate-block
@@ -146,14 +144,14 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Resolve wiki framework dep (file:../..)
         working-directory: examples/wiki
-        run: npm install --no-package-lock --omit=dev --install-links
+        run: npm ci --omit=dev --install-links
 
       - name: Run wiki e2e
         working-directory: examples/wiki
@@ -168,10 +166,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Compare against committed baseline
         # Fails on breaking changes (removed methods, type changes).
@@ -195,7 +193,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: 24.16.0
+          node-version: 24.18.0
       - name: Run vendor-currency check
         # Hits registry.npmjs.org/<pkg>/latest for each npm-mapped entry
         # (vendored bundles plus per-component versions on meta-bundles
@@ -220,7 +218,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: 24.16.0
+          node-version: 24.18.0
       - name: Run actions-currency check
         # Resolves each pinned `uses: owner/repo@<sha>  # vX.Y.Z` against
         # the GitHub API (releases/latest, falling back to highest
@@ -230,6 +228,13 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: node scripts/check-actions-currency.js
+      - name: Run pin-all check (committed lockfiles + Docker base digests in sync)
+        # Aggregated pin gate: verifies every committed lockfile (root / wiki /
+        # fuzz) matches its package.json so CI's `npm ci` pins the reviewed
+        # versions, and that the oss-fuzz base-image digest mirrors the tracked
+        # .clusterfuzzlite one. `node scripts/pin-all.js --fix` (with GH_TOKEN)
+        # re-pins every segment — lockfiles, Action SHAs, and Docker digests.
+        run: node scripts/pin-all.js
 
   secret-scan:
     name: Secret scan (gitleaks)
@@ -299,10 +304,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Build vendored-deps CycloneDX SBOM
         # The framework ships ZERO npm runtime deps — its security-critical
@@ -432,17 +437,17 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Install wiki deps (links @blamejs/core for the opts probe)
         # opts-resolver.js requires @blamejs/core at top-of-file; the
         # wiki workspace symlinks it via a file: dependency in
-        # examples/wiki/package.json. Run npm install before the
-        # validator so the symlink is present.
-        run: cd examples/wiki && npm install --silent
+        # examples/wiki/package.json. Run npm ci before the
+        # validator so the linked dep is present.
+        run: cd examples/wiki && npm ci --install-links --silent
 
       - name: Validate @module / @primitive comment blocks across lib/
         # Fast signal — no app boot, just walks lib/ for the source-driven
@@ -463,10 +468,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Run ESLint (max-warnings 0)
         # Capture full output so the PR comment / step summary can show

package/lib/vendor/blamejs/.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ jobs:
       # hop); the language ID picks up the .js files under lib/ +
       # scripts/ regardless.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
         with:
           languages: javascript-typescript
           # Scope (paths) + query suite (security-extended) live in the config
@@ -46,6 +46,6 @@ jobs:
       # Auto-build is skipped because CommonJS files don't need a build
       # step; CodeQL extracts straight from source.
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
         with:
           category: "/language:javascript-typescript"

package/lib/vendor/blamejs/.github/workflows/npm-publish.yml

@@ -99,10 +99,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
 
       - name: Compute version + is_tag flag
         id: version
@@ -146,7 +146,7 @@ jobs:
       - name: Install devDependencies (esbuild + postject for bundler-output smoke gate)
         # Exact-version pinned (matching ci.yml) — the publish path builds the
         # bundle with deterministic tool versions rather than floating latest.
-        run: npm install --no-audit --no-fund --no-save esbuild@0.28.1 postject@1.0.0-alpha.6
+        run: npm ci --no-audit --no-fund
 
       - name: Show Node + npm version
         run: |
@@ -186,7 +186,7 @@ jobs:
           set -euo pipefail
           cd examples/wiki
           rm -rf data data-e2e
-          npm install --silent
+          npm ci --install-links --silent
           node test/e2e.js
 
       - name: Generate CycloneDX SBOM (1.6) — npm-tree + vendored
@@ -389,10 +389,10 @@ jobs:
     # in under 3 minutes combined. 15-min cap is generous.
     timeout-minutes: 15
     steps:
-      - name: Set up Node 24.16.0 LTS + npm registry auth
+      - name: Set up Node 24.18.0 LTS + npm registry auth
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Download publish bundle (tarball + SBOMs + CHANGELOG)

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -59,10 +59,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
-      - name: Set up Node 24.16.0 LTS
+      - name: Set up Node 24.18.0 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.18.0'
       - name: Run ESLint (max-warnings 0)
         # Pinned to a known-good eslint version; matches ci.yml /
         # npm-publish.yml so the three pre-tag gates run identical
@@ -128,14 +128,14 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU (for ARM64 cross-build)
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4  # v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -187,7 +187,7 @@ jobs:
       # Note: load: true forces single-arch (amd64). The multi-arch
       # build happens on the post-scan push step below.
       - name: Build (local-only, for Trivy)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -238,7 +238,7 @@ jobs:
       - name: Push (multi-arch, after Trivy gate)
         id: push
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -340,7 +340,7 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4  # v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

package/lib/vendor/blamejs/.github/workflows/scorecard.yml

@@ -40,7 +40,7 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
         with:
           sarif_file: results.sarif
 

package/lib/vendor/blamejs/.gitignore

@@ -81,12 +81,12 @@ examples/*/data-e2e/
 # never reaches staging.
 examples/*/C\:/
 examples/wiki/C*/
-examples/*/package-lock.json
-# Top-level lockfile — the framework owns its stack via vendoring
-# (lib/vendor/) and runs zero npm deps (runtime OR dev). Any
-# package-lock.json that appears at the root is from a transient
-# `npm install` and shouldn't be tracked.
-/package-lock.json
+# Dev/example lockfiles ARE committed (root, examples/wiki, fuzz) so CI's
+# `npm ci` pins the reviewed dev-tool versions with integrity hashes and
+# OpenSSF Scorecard sees a pinned install. This does NOT relax the zero-npm-
+# RUNTIME-deps rule — the framework still ships zero runtime deps (everything
+# vendored under lib/vendor/); these lockfiles are dev/example-only and are
+# excluded from the published tarball's `files` allowlist.
 # Root-level runtime state — a test (or local run) that points b.db / the
 # cluster at a relative default writes its sealed vault key + encrypted
 # SQLite DB here. It is per-instance state, never repo content; the *.key /