@blamejs/core 0.14.27 → 0.15.1

package/lib/vendor-data.js

@@ -130,6 +130,7 @@ function _timingSafeHexEqual(a, b) {
 var KNOWN_VENDOR_DATA = Object.freeze({
   "public-suffix-list": {
     module: "./vendor/public-suffix-list.data",
+    // allow:hand-rolled-sql — `_blamejs_canary_*` is an in-payload tamper-canary token, not a SQL table name (no DB sink in this file)
     canary: "_blamejs_canary_v0_9_8_.local",
     // Canary parse check — operator-side `b.publicSuffix.isPublicSuffix(canary)`
     // MUST return true after the PSL parser ingests the data. The check
@@ -138,6 +139,7 @@ var KNOWN_VENDOR_DATA = Object.freeze({
   },
   "common-passwords-top-10000": {
     module: "./vendor/common-passwords-top-10000.data",
+    // allow:hand-rolled-sql — `_blamejs_canary_*` is an in-payload tamper-canary token, not a SQL table name (no DB sink in this file)
     canary: "_blamejs_canary_password_2026_05_13_blamejs_internal_",
     description: "Top-10000 most common passwords (SecLists). Used by b.auth.password to refuse known-breached credentials.",
   },

package/lib/websocket.js

@@ -971,6 +971,22 @@ class WebSocketConnection extends EventEmitter {
         self._transitionToClosed(1006, "abnormal closure", false, null);
       }
     });
+    socket.on("end", function ()        {
+      // Peer half-closed (TCP FIN) without sending a Close frame. HTTP
+      // 'upgrade' sockets default to allowHalfOpen=true, so this arrives
+      // as 'end' (readable side ended) while the writable side stays
+      // open — the 'close' handler above never fires and the connection
+      // would otherwise wedge open (ping timer running, no 'close' event,
+      // peer's socket never destroyed). RFC 6455 §7.1.1 treats a TCP
+      // close without a prior Close frame as abnormal closure: surface
+      // the lifecycle event and end our writable side so the socket
+      // actually tears down. _transitionToClosed is idempotent, so the
+      // native 'close' that follows is a no-op.
+      if (self._state !== STATE_CLOSED) {
+        self._transitionToClosed(1006, "abnormal closure", false, null);
+      }
+      try { socket.end(); } catch (_e) { /* socket already closing */ }
+    });
   }
 
   // Single state-transition method. Idempotent — repeat calls after

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.27",
+  "version": "0.15.1",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c78c9561-3578-4ff6-99f8-a3e2a52ddc17",
+  "serialNumber": "urn:uuid:167ad68f-23f7-47a4-a412-8703ce390619",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-07T00:11:04.881Z",
+    "timestamp": "2026-06-11T15:59:54.794Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.14.27",
+      "bom-ref": "@blamejs/core@0.15.1",
       "type": "application",
       "name": "blamejs",
-      "version": "0.14.27",
+      "version": "0.15.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.14.27",
+      "purl": "pkg:npm/%40blamejs/core@0.15.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.14.27",
+      "ref": "@blamejs/core@0.15.1",
       "dependsOn": []
     }
   ]