@blamejs/blamejs-shop 0.5.7 → 0.5.9

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.16.2",
-  "createdAt": "2026-07-03T12:18:24.287Z",
+  "frameworkVersion": "0.16.3",
+  "createdAt": "2026-07-03T20:45:25.445Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/examples/wiki/package-lock.json

@@ -16,7 +16,7 @@
       }
     },
     "node_modules/@blamejs/core": {
-      "version": "0.16.2",
+      "version": "0.16.3",
       "resolved": "file:../..",
       "license": "Apache-2.0",
       "bin": {

package/lib/vendor/blamejs/lib/content-credentials.js

@@ -137,6 +137,15 @@ function _validateBuildOpts(opts) {
  */
 function build(opts) {
   _validateBuildOpts(opts);
+  // A `typeof === "number"` gate alone lets NaN / Infinity / out-of-Date-range
+  // values through, which then crash `new Date(x).toISOString()` with an untyped
+  // RangeError. Config-time inputs reject with a typed error instead.
+  if (opts.generatedAt !== undefined &&
+      (typeof opts.generatedAt !== "number" || !isFinite(opts.generatedAt) ||
+       Math.abs(opts.generatedAt) > 8.64e15)) {
+    throw ContentCredentialsError.factory("content-credentials/bad-generated-at",
+      "contentCredentials.build: generatedAt must be a finite epoch-millis number within the valid Date range");
+  }
   var generatedAt = typeof opts.generatedAt === "number" ? opts.generatedAt : Date.now();
   var manifest = {
     "@context":   "https://c2pa.org/specifications/specifications/2.1/",
@@ -161,7 +170,24 @@ function build(opts) {
     // Optional operator-supplied display assertion (SB-942 §22757(b))
     visibleDisclosure: opts.visibleDisclosure || null,
   };
-  return Object.freeze(manifest);
+  // Deep-freeze — every claim field lives in a nested object (provider/system/
+  // content), so a top-level Object.freeze alone left content.id etc. mutable,
+  // contradicting the documented pre-sign immutability guarantee.
+  return _deepFreeze(manifest);
+}
+
+// Recursively freeze an object graph so no nested claim can be mutated before
+// signing. Cyclic input isn't produced here (manifest is a plain literal tree).
+function _deepFreeze(obj) {
+  if (obj && typeof obj === "object" && !Object.isFrozen(obj)) {
+    var keys = Object.keys(obj);
+    for (var i = 0; i < keys.length; i += 1) {
+      var v = obj[keys[i]];
+      if (v && typeof v === "object") _deepFreeze(v);
+    }
+    Object.freeze(obj);
+  }
+  return obj;
 }
 
 /**
@@ -672,6 +698,15 @@ function signCose(manifest, opts) {
   // 35) when a token was attached.
   var unprotEntries = [];
   if (Array.isArray(opts.certChain) && opts.certChain.length > 0) {
+    // Validate each entry is raw DER bytes — a non-Buffer element would reach
+    // Buffer.concat / _cborBytes and throw an untyped Node ERR_INVALID_ARG_TYPE
+    // instead of an operator-actionable typed rejection.
+    opts.certChain.forEach(function (der, idx) {
+      if (!Buffer.isBuffer(der) && !(der instanceof Uint8Array)) {
+        throw ContentCredentialsError.factory("content-credentials/bad-cert-chain",
+          "contentCredentials.signCose: certChain[" + idx + "] must be a Buffer/Uint8Array of DER bytes");
+      }
+    });
     var chainArray;
     if (opts.certChain.length === 1) {
       // Single-cert form: header value is the DER bytes directly.
@@ -1252,14 +1287,20 @@ function verifyIdentityAssertion(assertion, publicKeyPem, opts) {
   if (supplied.length !== bound.length) {
     return _fail("referenced-assertions-count-mismatch");
   }
+  // Multiset match — consume each bound hash as it is matched so duplicate
+  // supplied hashes ([A, A]) can't satisfy a binding of distinct hashes
+  // ([A, B]) while leaving hash(B) never re-confirmed (a transplant fail-open).
+  var boundRemaining = bound.slice();
   for (var i = 0; i < supplied.length; i += 1) {
-    if (bound.indexOf(supplied[i]) === -1) {
+    var mIdx = boundRemaining.indexOf(supplied[i]);
+    if (mIdx === -1) {
       if (auditOn) {
         audit.safeEmit({ action: "contentcredentials.identity_verified", outcome: "denied",
           metadata: { binding: sp.binding, reason: "assertion-hash-mismatch" } });
       }
       return _fail("assertion-hash-mismatch");
     }
+    boundRemaining.splice(mIdx, 1);
   }
 
   // (3) trust resolution. verified:true ONLY for x509 with a supplied

package/lib/vendor/blamejs/lib/guard-sql.js

@@ -1045,6 +1045,18 @@ function _inspectFragment(rawText, normalized, opts, issues) {
                "with a ? placeholder, or pass allowLiterals:true for a static literal",
     });
   }
+  // A value-expression fragment contains no statement separator at all — any
+  // top-level ';' violates the fragment contract, including a LONE or TRAILING
+  // one ("x = 1;") that the stacked-statement scan misses (it only fires on a
+  // second statement after the ';'). Literals/comments are masked in
+  // `normalized`, so a ';' here is genuinely top-level.
+  if (normalized.indexOf(";") !== -1) {
+    issues.push({
+      code: "sql.refuse", severity: "critical", kind: "semicolon-in-fragment",
+      ruleId: "sql.semicolon-in-fragment",
+      snippet: "top-level ';' in a value-expression fragment — a fragment must be a single expression",
+    });
+  }
 }
 
 // operator-sql mode — exactly one statement (stacked scan already
@@ -1122,6 +1134,23 @@ function _hasEmbeddedStringLiteral(sql) {
       continue;
     }
     if (ch === SQUOTE) return true;
+    // Postgres dollar-quoted string literal opener ($tag$ or $$, tag = identifier
+    // chars or empty) — an embedded dollar-quote is a string literal just like
+    // '...', and the fragment floor must refuse it the same way (the single-quote
+    // check alone let `x = $tag$secret$tag$` bypass the strict embedded-literal gate).
+    if (ch === "$") {
+      // The tag between the opening and closing '$' is identifier chars only
+      // (no '$', which terminates it) — char compares, not a regex literal, to
+      // keep the pattern out of the shared-regex-duplication detector.
+      var j = i + 1;
+      while (j < len) {
+        var tch = sql.charAt(j);
+        if (!((tch >= "a" && tch <= "z") || (tch >= "A" && tch <= "Z") ||
+              (tch >= "0" && tch <= "9") || tch === "_")) break;
+        j += 1;
+      }
+      if (j < len && sql.charAt(j) === "$") return true;
+    }
     i += 1;
   }
   return false;

package/lib/vendor/blamejs/lib/mcp.js

@@ -149,6 +149,7 @@ function refuse(res, code, message, id) {
   // HTTP status mapping for the JSON-RPC error code we reply with.
   res.statusCode = code === JSONRPC_PARSE_ERROR || code === JSONRPC_INVALID_REQUEST ? 400 :  // HTTP status code (RFC 9110)
                    code === JSONRPC_METHOD_NOT_FOUND ? 404 :                                  // HTTP status code (RFC 9110)
+                   code === JSONRPC_AUTH_REQUIRED ? 401 :                                     // RFC 6750 §3 — bearer challenge is 401
                    code === JSONRPC_INTERNAL_ERROR ? 500 : 400;                              // HTTP status code (RFC 9110)
   res.end(body);
 }
@@ -190,7 +191,11 @@ function _checkRedirectUri(uri, allowlist, errorClass) {
       "mcp: redirect_uri not in allowlist (OAuth 2.1 / RFC 9700 sec 4.1.1)");
   }
   var parsed;
-  try { parsed = safeUrl.parse(uri); }
+  // Allow http: through the PARSE (default is https-only) so a loopback
+  // http://localhost redirect (RFC 8252 native-app / CLI MCP client) reaches
+  // the isHttps||isLocal gate below instead of failing here as "did not parse".
+  // Non-loopback http is still refused by that gate (RFC 9700 §4.1.1).
+  try { parsed = safeUrl.parse(uri, { allowedProtocols: ["https:", "http:"] }); }
   catch (_e) {
     throw errorClass.factory("mcp/bad-redirect-uri",
       "mcp: redirect_uri did not parse");
@@ -321,7 +326,11 @@ function serverGuard(opts) {
         req.mcpClaims = claims || null;
 
         var path = String(req.url || "").split("?")[0];
-        if (path === "/register" || path.endsWith("/register")) {
+        // Strip trailing slashes for the match — most routers normalize
+        // `/register/` to the same handler, so the guard must too (an exact/
+        // suffix match on the raw path let `/register/` slip past the refusal).
+        var normPath = path.replace(/\/+$/, "");
+        if (normPath === "/register" || normPath.endsWith("/register")) {
           if (!allowDynamicRegister) {
             _emitDenied(req, "mcp.register.refused-static", "dynamic registration disabled", { path: path });
             return refuse(res, JSONRPC_METHOD_NOT_FOUND, "dynamic client registration is not permitted");
@@ -663,7 +672,22 @@ function _validateValueAgainstSchema(value, schema, path) {
     if (typeof schema.minimum === "number" && value < schema.minimum) return path + ": " + value + " < minimum " + schema.minimum;
     if (typeof schema.maximum === "number" && value > schema.maximum) return path + ": " + value + " > maximum " + schema.maximum;
   }
-  if (t === "object" && value && typeof value === "object" && !Array.isArray(value)) {
+  // A schema with `properties`/`required`/`additionalProperties` but no explicit
+  // `type: "object"` is valid + common JSON Schema — treat it as an object schema
+  // so those constraints are ENFORCED, not silently skipped (fail-open on the
+  // whole validation gate, OWASP LLM07).
+  var describesObject = t === "object" || (t === undefined &&
+    (schema.properties !== undefined || schema.required !== undefined ||
+     schema.additionalProperties !== undefined));
+  if (describesObject) {
+    // An inferred object schema (no explicit `type`) skips the top type-match,
+    // so a scalar / null / array would otherwise pass by simply skipping the
+    // checks below — the exact fail-open this branch exists to close. Reject a
+    // non-object value explicitly.
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return path + ": expected object, got " +
+        (Array.isArray(value) ? "array" : (value === null ? "null" : typeof value));
+    }
     if (Array.isArray(schema.required)) {
       for (var ri = 0; ri < schema.required.length; ri++) {
         if (!Object.prototype.hasOwnProperty.call(value, schema.required[ri])) {
@@ -766,7 +790,9 @@ var MCP_PROTOCOL_VERSIONS_ACCEPTED = ["2024-11-05", "2025-03-26", "2025-06-18",
  */
 function _assertProtocolVersion(req, opts) {
   opts = opts || {};
-  var accepted = Array.isArray(opts.accepted) && opts.accepted.length > 0
+  // An explicit empty `accepted: []` means "accept no version" (reject all), not
+  // "fall back to the default set" — only an absent/non-array value defaults.
+  var accepted = Array.isArray(opts.accepted)
     ? opts.accepted : MCP_PROTOCOL_VERSIONS_ACCEPTED;
   var hdr = req && req.headers && req.headers["mcp-protocol-version"];
   if (typeof hdr !== "string" || hdr.length === 0) {
@@ -854,6 +880,13 @@ function _samplingGuard(opts) {
       throw new McpError("mcp/sampling-too-many-messages",
         "sampling.guard: " + messages.length + " messages > maxMessagesPerRequest=" + maxMsg);
     }
+    // Reject a non-number maxTokens on this untrusted, server-initiated surface
+    // — a string "999999" would otherwise skip the numeric cap entirely and a
+    // downstream SDK that coerces it would blow past the budget (type-confusion).
+    if (samplingRequest.maxTokens !== undefined && typeof samplingRequest.maxTokens !== "number") {
+      throw new McpError("mcp/sampling-bad-max-tokens",
+        "sampling.guard: maxTokens must be a number");
+    }
     if (typeof samplingRequest.maxTokens === "number" && samplingRequest.maxTokens > maxTokens) {
       throw new McpError("mcp/sampling-too-many-tokens",
         "sampling.guard: requested maxTokens " + samplingRequest.maxTokens +

package/lib/vendor/blamejs/lib/metrics.js

@@ -282,7 +282,15 @@ function _resolveLabels(defaultLabels, declaredNames, callLabels) {
         "label '" + declaredNames[n] + "' is required (declared in labelNames)");
     }
   }
-  return out;
+  // Redact credential-shaped values on the resolved labels themselves — the
+  // stored entry.labels are rendered verbatim into the exposition stream, so
+  // redacting only inside _labelsKey (the Map cardinality key) left raw bearer
+  // tokens / API keys / JWTs reaching /metrics. _labelsKey re-runs the same
+  // coercion, so this stays idempotent.
+  var redacted = {};
+  var ok = Object.keys(out);
+  for (var r = 0; r < ok.length; r++) redacted[ok[r]] = _validateLabelValue(out[ok[r]]);
+  return redacted;
 }
 
 // ---- registry factory ----
@@ -384,6 +392,10 @@ function create(opts) {
       values:     values,
       inc: function (callLabels, n) {
         var arg = _normalizeLabelArg(callLabels, n, 1);
+        if (typeof arg.value !== "number" || !isFinite(arg.value)) {
+          throw new MetricsError("metrics/counter-bad-value",
+            "counter.inc value must be a finite number");
+        }
         if (arg.value < 0) {
           throw new MetricsError("metrics/counter-decrement",
             "counter.inc value must be >= 0 (got " + arg.value + ") — counters never decrease");
@@ -454,7 +466,7 @@ function create(opts) {
       values:     values,
       set: function (callLabels, v) {
         var arg = _normalizeLabelArg(callLabels, v, NaN);
-        if (typeof arg.value !== "number" || isNaN(arg.value)) {
+        if (typeof arg.value !== "number" || !isFinite(arg.value)) {
           throw new MetricsError("metrics/gauge-bad-value",
             "gauge.set value must be a finite number");
         }
@@ -520,7 +532,7 @@ function create(opts) {
       values:     values,
       observe: function (callLabels, v, exemplar) {
         var arg = _normalizeLabelArg(callLabels, v, NaN);
-        if (typeof arg.value !== "number" || isNaN(arg.value)) {
+        if (typeof arg.value !== "number" || !isFinite(arg.value)) {
           throw new MetricsError("metrics/histogram-bad-value",
             "histogram.observe value must be a finite number");
         }

package/lib/vendor/blamejs/lib/middleware/tus-upload.js

@@ -157,8 +157,12 @@ function _parseChecksumHeader(headerValue, allowedSet) {
   var algo = kvp.key;
   var digestB64 = kvp.value.trim();
   if (algo.length === 0 || digestB64.length === 0) return { error: "malformed" };
-  if (!allowedSet[algo]) return { error: "algo-unsupported" };
+  // hasOwnProperty-guarded lookups — a bare `allowedSet[algo]` resolves
+  // Object.prototype for algo="__proto__"/"constructor" (truthy), bypassing the
+  // unsupported-algo guard and handing createHash a non-string → HTTP 500.
+  if (!Object.prototype.hasOwnProperty.call(allowedSet, algo)) return { error: "algo-unsupported" };
   if (!/^[A-Za-z0-9+/=]+$/.test(digestB64)) return { error: "malformed" };
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_CHECKSUM_ALGORITHMS, algo)) return { error: "algo-unsupported" };
   var nodeAlgo = KNOWN_CHECKSUM_ALGORITHMS[algo];
   if (!nodeAlgo) return { error: "algo-unsupported" };
   return { algo: algo, nodeAlgo: nodeAlgo, digestB64: digestB64 };
@@ -570,7 +574,10 @@ function create(opts) {
     if (rec.length === null && req.headers["upload-length"] !== undefined) {
       // Upload-Defer-Length finalization (§4.3) — declare length on first PATCH
       var declared = parseInt(req.headers["upload-length"], 10);
-      if (!isFinite(declared) || declared < 0) {
+      // Same strict parse the POST creation path uses — reject trailing junk
+      // ("10abc" → 10, "0x10" → 0) rather than parseInt-ing leniently.
+      if (!isFinite(declared) || declared < 0 ||
+          String(declared) !== String(req.headers["upload-length"]).trim()) {
         return _writeError(res, STATUS_BAD_REQUEST, "Upload-Length must be a non-negative integer");
       }
       if (maxSize !== undefined && declared > maxSize) {

package/lib/vendor/blamejs/lib/parsers/safe-yaml.js

@@ -262,6 +262,14 @@ function parse(input, opts) {
       return _parseBlockSequence(k, indent, depth);
     }
 
+    // Root-level flow collection ({...} / [...]) — recognize the flow bracket
+    // BEFORE the block-mapping key scan. Otherwise a root JSON/flow object like
+    // '{a: 1, b: 2}' matches the block-mapping key scan (the first ': ' makes
+    // '{a' look like a bare key) and silently returns structurally-wrong data.
+    if (content.charAt(0) === "{" || content.charAt(0) === "[") {
+      return { value: _parseInlineValue(content, firstLine.lineNumber, indent), nextLine: k + 1 };
+    }
+
     // Block mapping starts with a key (bare or quoted) followed by `:`.
     var keyRange = _scanKeyRange(content, firstLine.lineNumber, indent);
     if (keyRange) {
@@ -493,8 +501,19 @@ function parse(input, opts) {
     // Strip trailing whitespace/comment already done by caller (mostly).
     // Handle: flow [...] / {...}, quoted strings, plain scalars.
     var t = text;
-    if (t.charAt(0) === "[") return _parseFlowSequence(t, lineNumber, col, 0);
-    if (t.charAt(0) === "{") return _parseFlowMapping(t, lineNumber, col, 0);
+    if (t.charAt(0) === "[" || t.charAt(0) === "{") {
+      // Reject trailing junk after a flow collection (matching the quoted-scalar
+      // branch below) using _parseFlowValue's end position, then return the value
+      // via the direct parser so the shape is identical to the pre-existing path.
+      var fend = _parseFlowValue(t, 0, lineNumber, col, 0).nextPos;
+      var afterFlow = t.slice(fend).replace(/^\s+/, "");
+      if (afterFlow.length > 0 && afterFlow.charAt(0) !== "#") {
+        throw new SafeYamlError("unexpected content after flow collection",
+          "yaml/trailing-content", lineNumber, col);
+      }
+      return t.charAt(0) === "[" ? _parseFlowSequence(t, lineNumber, col, 0)
+                                 : _parseFlowMapping(t, lineNumber, col, 0);
+    }
     if (t.charAt(0) === '"') {
       var dq = _decodeDoubleQuoted(t, lineNumber, col);
       var afterDq = _trailingAfterQuoted(t, '"');
@@ -570,6 +589,18 @@ function parse(input, opts) {
         throw new SafeYamlError("forbidden key '" + key + "'",
           "yaml/poisoned-key", lineNumber, col + p);
       }
+      // Mirror the block-mapping guards so flow style can't bypass them:
+      // the merge key '<<' is banned, and a duplicate key is refused (block
+      // rejects both; flow previously accepted '<<' as a literal key and
+      // silently kept the LAST value on a repeat — a config-override risk).
+      if (key === "<<") {
+        throw new SafeYamlError("merge key '<<' not supported (anchor-using feature)",
+          "yaml/merge-key-banned", lineNumber, col + p);
+      }
+      if (Object.prototype.hasOwnProperty.call(result, key)) {
+        throw new SafeYamlError("duplicate mapping key '" + key + "'",
+          "yaml/duplicate-key", lineNumber, col + p);
+      }
       _bumpKeys(lineNumber);
       p = keyVal.nextPos;
       p = _flowSkipWsIndex(text, p);

package/lib/vendor/blamejs/lib/safe-buffer.js

@@ -69,7 +69,17 @@ class SafeBufferError extends FrameworkError {
 
 function _throw(errorClass, message, code) {
   var Cls = errorClass || SafeBufferError;
-  throw new Cls(message, code);
+  var err = new Cls(message, code);
+  // SafeBufferError takes (message, code) but a defineClass errorClass (the
+  // convention for every framework-error, e.g. a caller's TusError) takes
+  // (code, message) — the opposite order — so `new Cls(message, code)` would
+  // SWAP .code/.message for such a class (a caller branching on e.code then
+  // never matches). Set both fields explicitly so they are correct whichever
+  // constructor order the passed class uses; the class-derived flags are set
+  // from the class options, not the code value, so this is safe.
+  err.code = code;
+  err.message = message;
+  throw err;
 }
 
 /**

package/lib/vendor/blamejs/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@blamejs/core",
-      "version": "0.16.2",
+      "version": "0.16.3",
       "license": "Apache-2.0",
       "bin": {
         "blamejs": "bin/blamejs.js"

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.16.3.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.16.3",
+  "date": "2026-07-03",
+  "headline": "A batch of fail-open, injection-bypass and error-path fixes across the metrics, guard-sql, MCP, YAML-parser, content-credentials, tus-upload and buffer primitives — including a credential-leak fix on the /metrics exposition surface — alongside a further expansion of the automated test suite",
+  "summary": "This patch closes a set of security and robustness defects concentrated in the error-handling and adversarial-input paths of the observability, SQL-guard, MCP, YAML-parsing, content-credentials and resumable-upload primitives, surfaced while continuing to expand the automated test suite. The most consequential: credential-shaped metric label values were redacted only in the internal cardinality key, not in the rendered exposition, so a raw bearer token / API key / JWT placed on a label leaked verbatim to every `/metrics` scrape reader — redaction now applies to the stored labels the exposition renders. The SQL guard's fragment mode (the `whereRaw` escape hatch) refused an embedded single-quoted literal but not a PostgreSQL dollar-quoted string (`$tag$…$tag$`) or a lone top-level `;`, so operator concatenation into a dollar-quoted context bypassed the floor that forces `?`-placeholder binding. MCP tool-input validation was fail-open when a JSON Schema omitted an explicit top-level `type:\"object\"` (a valid, common shape) — `required`/`properties`/`additionalProperties` were skipped and any input accepted; and its server-initiated sampling token cap was bypassable with a string `maxTokens`. The YAML parser's flow style (`{…}` / `[…]`) accepted duplicate keys and the merge key that block style rejects — letting a later value silently override an earlier one a preceding check had already read — and mis-parsed a root-level JSON object. content-credentials returned a only shallowly-frozen manifest (nested claim fields stayed mutable before signing), and its identity-assertion hash re-check used set membership rather than multiset matching, so duplicate referenced assertions could leave a bound assertion never re-confirmed. Robustness fixes round out the batch: metrics now reject `±Infinity`; the buffer collector preserves a caller error class's code/message (they were swapped for framework error classes, so a caller branching on the error code — e.g. a resumable-upload `413` vs `400` — never matched); resumable uploads return `413` (not a `400` that leaked the internal error code) on an oversized chunk, reject a prototype-key checksum algorithm with `400` (not `500`), and parse a deferred `Upload-Length` as strictly as creation; the MCP guard refuses `/register/` (trailing slash) like `/register`, answers a missing/invalid bearer with `401` and its `WWW-Authenticate` challenge instead of `400`, honors an explicit empty accepted-version list, and accepts a loopback `http` redirect URI for native/CLI clients while still refusing non-loopback `http`.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Credential-shaped metric labels are redacted in the `/metrics` exposition, not just the cardinality key",
+          "body": "The metrics registry rewrote a credential-shaped label value to `[REDACTED-CREDENTIAL]`, but only inside the function that builds the internal Map cardinality key. The stored label object — the one the exposition renderer emits — kept the raw value, so a bearer token, API key or JWT placed on a label (e.g. an `authorization` label) was written verbatim to every `/metrics` scrape reader, contradicting the documented guarantee that the bytes never reach the scrape stream. Redaction now runs on the resolved labels themselves, so the key and the rendered output both carry the marker."
+        },
+        {
+          "title": "SQL guard fragment mode refuses PostgreSQL dollar-quoted literals and any top-level semicolon",
+          "body": "In fragment mode (`whereRaw`), the embedded-string-literal floor that forces every value through a `?` placeholder detected a single-quoted literal but not a dollar-quoted one (`$tag$…$tag$` or `$$…$$`), so operator input concatenated into a dollar-quoted context passed the strict floor that the equivalent single-quoted value is refused by. The floor now recognizes dollar-quoted literals. Fragment mode also now refuses any top-level `;` — including a lone or trailing one — rather than relying on the stacked-statement scan, which only fired when a second statement followed the `;`."
+        },
+        {
+          "title": "MCP tool-input validation enforces the schema without an explicit `type:\"object\"`",
+          "body": "`validateToolInput` gated the `required` / `properties` / `additionalProperties` checks on the schema declaring `type:\"object\"`. A schema that carries `properties`/`required` but omits `type` — a valid and common JSON Schema shape — was treated as untyped, so those constraints were skipped and any argument object was accepted, defeating the primitive's stated purpose (OWASP LLM07). Such a schema is now treated as an object schema and its constraints enforced."
+        },
+        {
+          "title": "MCP sampling token cap rejects a non-numeric `maxTokens`",
+          "body": "`sampling.guard` applied the per-request token cap only when `maxTokens` was a number, so a hostile-tool-initiated sampling request carrying `maxTokens` as a string skipped the cap entirely — and a downstream SDK that coerces the string would then exceed the budget. A non-numeric `maxTokens` on this server-initiated surface is now refused with a typed error."
+        },
+        {
+          "title": "content-credentials identity-assertion re-check uses multiset matching",
+          "body": "`verifyIdentityAssertion` re-confirmed the signed referenced-assertion hash binding with count-equality plus set membership, never consuming a matched entry. Supplying referenced assertions that hash to `[A, A]` against a signed binding of `[A, B]` passed — the counts matched and each supplied hash was present — even though the bound `hash(B)` was never re-confirmed against a real assertion (a transplant fail-open). The re-check now consumes each bound hash as it is matched, so duplicates can no longer stand in for a distinct bound assertion."
+        },
+        {
+          "title": "YAML flow-style mappings refuse duplicate keys and the merge key like block style",
+          "body": "Block mappings rejected a duplicate key (`yaml/duplicate-key`) and the anchor-merge key `<<` (`yaml/merge-key-banned`), but flow mappings (`{ a: 1, a: 2 }`) enforced neither — silently keeping the last value on a repeat and accepting `<<` as an ordinary key. A value an earlier check has already read could thus be overridden through flow style. Flow mappings now apply both guards."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Metrics reject non-finite values",
+          "body": "`gauge.set`, `histogram.observe` and `counter.inc` guarded their value with an `isNaN`-only check (counter only checked `< 0`), so `±Infinity` passed and produced `Infinity` / `-Infinity` in the exposition — invalid Prometheus 0.0.4 / OpenMetrics, which a scraper rejects. All three now require a finite number, matching their `must be a finite number` error text."
+        },
+        {
+          "title": "Buffer stream collector preserves a caller error class's code and message",
+          "body": "`safeBuffer.collectStream` constructs its size-limit error with `(message, code)`, matching its own error class — but a framework error class (the convention elsewhere) takes `(code, message)`, the opposite order, so a caller that passed its own error class received an error with `code` and `message` swapped. A caller branching on the error code then never matched — for example the resumable-upload handler mapped an oversized chunk to `400` instead of `413`. The collector now sets both fields explicitly so they are correct whichever constructor order the passed class uses."
+        },
+        {
+          "title": "Resumable upload: correct status codes and strict deferred-length parse",
+          "body": "An oversized `PATCH`/creation chunk now returns `413 Payload Too Large` instead of a `400` whose body leaked the internal error code; an `Upload-Checksum` naming a prototype key (e.g. `__proto__`) returns `400 unsupported` instead of a `500` from an unguarded lookup; and a deferred-length finalization now parses `Upload-Length` with the same strict check as creation, rejecting trailing junk (`\"10abc\"`) rather than silently truncating it."
+        },
+        {
+          "title": "MCP guard: trailing-slash registration refusal, 401 bearer challenge, empty accepted-version list",
+          "body": "The static-registration refusal matched `/register` exactly or by suffix, so `/register/` — which most routers normalize to the same handler — slipped through; it is now refused too. A missing or invalid bearer now returns `401 Unauthorized` with its `WWW-Authenticate` challenge (RFC 6750 §3) instead of `400`, so clients keyed on `401` re-authenticate. And an explicit empty `accepted` protocol-version list now rejects every version instead of silently widening to the default set."
+        },
+        {
+          "title": "MCP accepts a loopback `http` redirect URI",
+          "body": "`redirect_uri` validation parsed the URI with the default HTTPS-only protocol set, so a loopback `http://localhost/…` redirect (RFC 8252 native-app / CLI client, permitted by RFC 9700 §4.1.1) failed as `did not parse` before the local-host allowance could run. The parse now admits `http` so the loopback allowance applies; a non-loopback `http` redirect is still refused."
+        },
+        {
+          "title": "YAML: trailing content after a flow collection and root-level JSON objects",
+          "body": "`root: [1, 2] junk` silently dropped the trailing content where the quoted-scalar path rejects it; trailing content after a flow collection is now refused (`yaml/trailing-content`). A root-level flow/JSON object (`{\"a\": 1, \"b\": 2}`) was mis-scanned as a block mapping with a garbage key and returned structurally-wrong data; the leading flow bracket is now recognized before the block-mapping scan so a root JSON object parses correctly."
+        },
+        {
+          "title": "content-credentials: deep-frozen manifest and typed rejections for bad build/sign inputs",
+          "body": "`build` returned a shallowly-frozen manifest, leaving every nested claim field (`provider`/`system`/`content`) mutable before signing despite the documented pre-sign immutability guarantee; the manifest is now deep-frozen. A non-finite or out-of-Date-range `generatedAt` (`NaN` / `Infinity`) crashed with an untyped `RangeError`, and a non-Buffer `certChain` entry to `signCose` threw an untyped Node `TypeError`; both now reject with a typed `content-credentials/*` error at call time."
+        }
+      ]
+    }
+  ]
+}