@blamejs/core 0.15.38 → 0.15.40

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.40 (2026-06-27) — **The durable webhook dispatcher's retry poller now claims due deliveries with FOR UPDATE SKIP LOCKED on Postgres and MySQL, so two pollers running at once (multiple app nodes) can no longer both grab the same delivery and send the webhook twice in one cycle.** The webhook dispatcher's retry poller claimed due deliveries by flipping them pending->in-flight and then re-selecting the in-flight rows by id. On Postgres or MySQL under the default READ COMMITTED isolation, two pollers running concurrently could both re-select the same row: the loser's UPDATE matched zero rows (the winner had already flipped it), but its reselect-by-id still re-read the row the winner had just claimed, so both pollers attempted the same HTTP delivery in one cycle. The claim now row-locks the due rows with SELECT ... FOR UPDATE SKIP LOCKED on the row-locking backends, so concurrent pollers see disjoint sets and each delivery is claimed by exactly one poller; sqlite (a single writer) keeps the existing mark-then-reselect, which it serializes safely. This matches the claim used by the framework's transactional outbox and cluster queue. Receivers that already dedup on the X-Webhook-Delivery-Id header were protected from a duplicate POST; this closes the at-most-once-per-cycle gap at the dispatcher itself. **Fixed:** *Webhook retry pollers no longer double-deliver under concurrency on Postgres / MySQL* — b.webhook.dispatcher's processRetries() claimed due deliveries with a mark-then-reselect that had no row lock, so on Postgres / MySQL at READ COMMITTED two concurrent pollers (for example, the dispatcher running on more than one app node) could both hand back the same delivery and POST it twice in a single retry cycle. The claim now uses SELECT ... FOR UPDATE SKIP LOCKED on those backends so each due row is locked by exactly one poller and concurrent pollers claim disjoint sets; the rows a poller selects are exactly the rows it owns. sqlite keeps the mark-then-reselect path, which its single writer serializes. Operators running the dispatcher on a single node, or whose receivers dedup on X-Webhook-Delivery-Id, were not exposed to a duplicate delivery; no configuration change is required to pick up the fix. **Detectors:** *Build guard: a competing-consumer claim must use FOR UPDATE SKIP LOCKED* — A codebase guard now fails the build if a poller that claims due rows across workers — SELECT status='pending' inside a transaction, then flip the rows to in-flight — omits FOR UPDATE SKIP LOCKED on the row-locking backends. Without the row lock, two pollers under READ COMMITTED both claim the same row; the guard keeps any future poller from re-introducing the shape, with the transactional outbox and cluster queue as the reference claims.
+
+- v0.15.39 (2026-06-27) — **Nine more places that matched an operator-supplied regex against request data — User-Agent, Origin, request path, form fields, SMTP HELO, release-asset names — now screen the pattern for catastrophic backtracking (ReDoS) before use, and a new b.guardRegex.assertSafe helper makes that screening one call.** The previous release screened feature-flag and MCP regex patterns for ReDoS but did not sweep every place the framework matches an operator-supplied regex against attacker-controlled input. Nine more were found and fixed: the bot guard (User-Agent), CORS (Origin), the HTTP span middleware and the shared request skip-matcher used by CSRF / fetch-metadata / rate-limit / access-lock / age-gate and the request logger (request path), static serving (hashed-asset path pattern), form field validation (submitted field value), SMTP HELO generic-rDNS patterns (HELO name), and the self-updater's asset/signature patterns (names from a remote release feed). Each accepted an operator RegExp with only a type check and ran it on every matching request, so an accidentally catastrophic pattern such as (a+)+$ or ((a)+)+$ could pin a CPU on a crafted input — a length cap does not bound backtracking. Every one now screens the pattern through b.guardRegex at configuration time. A new b.guardRegex.assertSafe(input, label?, ErrorClass?, code?) primitive performs that screen in one call (accepting a RegExp or a pattern string), which operators can also use on their own patterns. **Added:** *b.guardRegex.assertSafe — screen a RegExp or pattern string for ReDoS in one call* — b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?) screens an already-compiled RegExp (its source) or a raw pattern string for the catastrophic-backtracking classes — nested, alternation-with, and lookaround quantifiers — throwing the supplied framework-error class (or the underlying GuardRegexError) on a hostile pattern and returning the input on success. It allows large or open-ended bounded repeats (`{8,}`, `{n,m}`): a single counted repeat matches in linear time and legitimate patterns (including the framework's own defaults) use them. It is the config-time guard used by the request-lifecycle fixes above, and operators can apply it to their own patterns before matching them against untrusted input. **Security:** *Operator regex patterns matched against request data are screened for ReDoS framework-wide* — An operator-supplied RegExp matched against attacker-controllable input is a denial-of-service surface if it has a catastrophic-backtracking shape: the input triggers exponential work in the regex engine. Nine sites accepted such patterns with only an `instanceof RegExp` type check and executed them per request — bot-guard against the User-Agent, CORS against the Origin header, the HTTP span middleware and the shared skip-path matcher (CSRF / fetch-metadata / rate-limit / access-lock / age-gate / request-log) against the request path, static serving against the request path, form validation against the submitted field value, SMTP HELO checks against the HELO name, and the self-updater against asset names from a remote release feed. Each now routes the pattern through b.guardRegex at configuration time, so a catastrophic shape is refused up front instead of being weaponized by a crafted request. A length bound on the input is not a defense: a nested-quantifier pattern backtracks catastrophically at a few dozen characters. **Detectors:** *Build guard: an operator regex matched against request input must be ReDoS-screened* — A codebase guard now fails the build if a primitive accepts an operator-supplied RegExp and executes it against request input without screening the pattern through b.guardRegex.assertSafe — so the catastrophic-backtracking class fixed in this release cannot be reintroduced at a new site (the trusted-input cases — local filesystem paths, operator config keys, operator-owned schemas — are explicitly allowlisted). · *Build guard: process.moduleLoadList filters must match the 'NativeModule X' naming* — A guard now fails the build if a test filters process.moduleLoadList by the 'node:X' name only. Node 20+ records a loaded builtin as 'NativeModule X', so a 'node:'-only filter in an edge-runtime no-eager-load test would rot green and miss a reintroduced top-level networking require.
+
 - v0.15.38 (2026-06-27) — **Regex patterns supplied in feature-flag targeting rules and MCP tool input schemas are now screened for catastrophic-backtracking (ReDoS) shapes before compilation, so a pattern matched against request data can't pin a CPU.** Two places compiled a caller-supplied regex pattern and `.test()`'d it against request-controlled input with only a length bound as the stated defense: a feature-flag targeting condition (`op: "regex"`) matched against runtime attribute values, and an MCP tool's input-schema `pattern` matched against tool-call arguments. A length bound is not a ReDoS defense — a catastrophic-backtracking pattern such as `(a+)+$` is six characters and pins a CPU on a crafted input. Both patterns now pass through `b.guardRegex` (strict profile) before compilation, which refuses nested-quantifier, alternation-with-quantifier, and quantifier-inside-lookaround shapes. A ReDoS-shaped flag pattern is refused when the rules are validated; a ReDoS-shaped MCP schema pattern fails tool-input validation. Patterns built from the framework's own static tables, operator-owned JSON Schema patterns, the Sieve glob translator (which cannot express nested quantifiers), and the I-Regexp translator (linear by dialect) are unchanged. **Security:** *Feature-flag regex targeting conditions are screened for ReDoS before compilation* — A flag targeting rule with `op: "regex"` compiled the operator-supplied pattern and `.test()`'d it against runtime attribute values, guarded only by a 200-character length cap. Length does not bound catastrophic backtracking, so a pattern like `(a+)+$` combined with an attacker-controlled attribute value could pin a CPU during flag evaluation. The pattern is now screened through b.guardRegex (strict) when the rules are validated, and a catastrophic-backtracking shape is refused with a clear error. · *MCP tool input-schema patterns are screened for ReDoS before matching request input* — b.mcp.validateToolInput compiled a tool author's input-schema `pattern` and matched it against tool-call argument values; the 4096-character input cap does not bound backtracking (a `(a+)+$` pattern blows up at roughly forty input characters). The schema pattern is now screened through b.guardRegex (strict) before compilation, so a ReDoS-shaped pattern in a registered tool's schema fails input validation instead of letting hostile arguments hang the validator. · *b.guardRegex now catches wrapped nested-quantifier patterns* — The nested-quantifier detector matched a quantified group whose body contained a quantifier, but its inner match was paren-blind, so wrapping the inner quantifier in an extra group — `((a)+)+`, `(([a-z]+)*)*`, `((a+))+` — slipped past it while remaining catastrophic. A structural scan now tracks group nesting and refuses an unbounded-quantified group whose body itself contains an unbounded quantifier at any depth, so the wrapped forms are rejected alongside the bare `(a+)+`. Bounded repeats (`{n}`, `{n,m}`) are unaffected. This strengthens every b.guardRegex caller, including the flag-targeting and MCP screening above.
 
 - v0.15.37 (2026-06-27) — **Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures.** A number of configuration options validated a numeric value with a bare `typeof === "number" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation "good" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect "retry indefinitely", inbox "retain indefinitely" — continue to accept `Infinity`. **Security:** *A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks* — b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === "number" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP "good" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`. · *WebSocket-client inbound caps can no longer be disabled by an Infinity value* — b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate "reconnect indefinitely" intent). · *Inbox, flag-cache, and audit-chain caps reject a non-finite limit* — The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely).

package/lib/flag-targeting.js

@@ -178,14 +178,9 @@ function validateRules(rules, label) {
         // bound does NOT defend ReDoS (`(a+)+$` is 6 chars); screen the pattern
         // through b.guardRegex first — it refuses nested-quantifier / alternation-
         // quantifier / lookaround-quantifier shapes before compilation.
+        guardRegex().assertSafe(cond.value, clabel + ".value", FlagError, "flag/bad-condition");
         try {
-          guardRegex().sanitize(cond.value, { profile: "strict" });
-        } catch (ge) {
-          throw new FlagError("flag/bad-condition",
-            clabel + ".value: regex pattern rejected as unsafe (ReDoS shape) - " + ge.message);
-        }
-        try {
-          // allow:dynamic-regex — operator targeting pattern, ReDoS-screened via guardRegex.sanitize (strict) + length-bounded to 200 chars above
+          // allow:dynamic-regex — operator targeting pattern, ReDoS-screened via guardRegex.assertSafe + length-bounded to 200 chars above
           validatedCond._compiledRegex = new RegExp(cond.value);
         } catch (e) {
           throw new FlagError("flag/bad-condition",

package/lib/forms.js

@@ -34,6 +34,7 @@
  */
 var C = require("./constants");
 var { generateToken, timingSafeEqual } = require("./crypto");
+var guardRegex = require("./guard-regex");
 var safeSchema = require("./safe-schema");
 var safeUrl = require("./safe-url");
 var template = require("./template");
@@ -198,6 +199,10 @@ function _renderInput(field) {
         "'.pattern must be a pre-compiled RegExp; got " +
         (typeof field.pattern) + ". Wrap the source string with `RegExp` at config time.");
     }
+    // Screen the operator-supplied pattern for catastrophic-backtracking
+    // (ReDoS) shapes at config time so a hostile-form-spec can't stage a
+    // pathological regex against the engine.
+    guardRegex.assertSafe(field.pattern, "forms: field[" + field.name + "].pattern");
     attrs.push('pattern="' + escapeAttribute(field.pattern.source) + '"');
   }
   if (field.min !== undefined)        attrs.push('min="' + escapeAttribute(field.min) + '"');
@@ -490,6 +495,10 @@ function validate(spec, body) {
             "'.pattern must be a pre-compiled RegExp; got " +
             (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
         }
+        // Screen the operator-supplied pattern for catastrophic-backtracking
+        // (ReDoS) shapes before the test, so a pathological regex can't be
+        // run against the submitted value.
+        guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
         if (!f.pattern.test(coerced)) {
           errors[f.name] = f.errorMessages && f.errorMessages.pattern
             ? f.errorMessages.pattern

package/lib/guard-regex.js

@@ -512,6 +512,61 @@ function gate(opts) {
 // ---- adaptive integration-test fixtures (consumed by layer-5 host harness) ----
 var INTEGRATION_FIXTURES = gateContract.identifierFixtures("^[a-z]+$", "(a+)+b");
 
+/**
+ * @primitive  b.guardRegex.assertSafe
+ * @signature  b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?)
+ * @since      0.15.39
+ * @status     stable
+ * @related    b.guardRegex.sanitize, b.guardRegex.validate
+ *
+ * Screen an already-compiled <code>RegExp</code> (or a raw pattern string) for
+ * catastrophic-backtracking (ReDoS) shapes, throwing if the pattern is unsafe.
+ * This is the config-time guard for request-lifecycle code that matches an
+ * operator-supplied regex against attacker-controlled input (User-Agent,
+ * Origin, request path, form field, HELO) — an accidentally-catastrophic
+ * operator pattern would otherwise be a per-request DoS once a hostile input
+ * triggers the backtracking.
+ *
+ * Pass a <code>RegExp</code> instance (its <code>.source</code> is screened) or
+ * a pattern string. On a hostile shape it throws <code>ErrorClass(code, ...)</code>
+ * when an error class is supplied, otherwise the underlying
+ * <code>GuardRegexError</code>. Returns the input unchanged on success.
+ *
+ * By default it rejects the catastrophic-backtracking classes — nested,
+ * alternation-with, and lookaround quantifiers — but ALLOWS large/open bounded
+ * repeats (<code>{8,}</code>, <code>{n,m}</code>): a single counted repeat is
+ * linear, not exponential, and legitimate patterns (e.g. a hex hash of 8+
+ * digits) use them. Pass an explicit <code>opts</code> to override.
+ *
+ * @opts
+ *   profile:             string,   // guardRegex profile (default: "strict")
+ *   boundedRepeatPolicy: string,   // default: "allow" (large bounded repeats are linear)
+ *
+ * @example
+ *   b.guardRegex.assertSafe(/^[a-z]+$/);            // ok — returns the RegExp
+ *   b.guardRegex.assertSafe(/\.[a-f0-9]{8,}\./);    // ok — a single bounded repeat is linear
+ *   try { b.guardRegex.assertSafe(/((a)+)+$/); }    // throws — nested quantifier
+ *   catch (e) { e.code; }                           // → "regex/unsafe-pattern"
+ */
+function assertSafe(input, label, ErrorClass, code, opts) {
+  var source = (input instanceof RegExp) ? input.source : input;
+  try {
+    // Screen the catastrophic-backtracking classes (nested / alternation /
+    // lookaround quantifiers — held at every profile) but allow large bounded
+    // repeats: a counted repeat matches in linear time, and rejecting `{n,}`
+    // would refuse legitimate operator patterns (and the framework's own
+    // defaults, e.g. b.staticServe.DEFAULT_HASHED_PATTERN's `{8,}`).
+    _guard.sanitize(source, opts || { profile: "strict", boundedRepeatPolicy: "allow" });
+  } catch (e) {
+    if (ErrorClass) {
+      throw new ErrorClass(code || "regex/unsafe-pattern",
+        (label || "regex") + ": pattern rejected as unsafe (ReDoS shape) - " + (e && e.message));
+    }
+    throw e;
+  }
+  return input;
+}
+
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
@@ -530,3 +585,5 @@ var _guard = module.exports = gateContract.defineGuard({
   intOpts:           ["maxBytes", "maxPatternBytes", "maxBoundedRepeat", "maxConsecutiveStars"],
   gate:        gate,
 });
+
+_guard.assertSafe = assertSafe;

package/lib/mail-helo.js

@@ -105,6 +105,7 @@ var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var guardRegex         = require("./guard-regex");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -210,6 +211,19 @@ async function evaluate(ctx, opts) {
   var selfNames = (opts.selfNames || []).map(function (n) { return String(n).toLowerCase(); });
   var auditImpl = opts.audit || audit();
 
+  // Screen operator-supplied generic-rDNS patterns ONCE at build time —
+  // they are .test()'d per-match against attacker-controlled rDNS / claim
+  // names, so a catastrophic-backtracking shape would be a ReDoS lever.
+  if (Array.isArray(opts.genericRdnsPatterns)) {
+    for (var gi = 0; gi < opts.genericRdnsPatterns.length; gi += 1) {
+      var gre = opts.genericRdnsPatterns[gi];
+      if (gre instanceof RegExp) {
+        guardRegex.assertSafe(gre, "mail.helo.evaluate: genericRdnsPatterns[" + gi + "]",
+          MailHeloError, "mail-helo/unsafe-pattern");
+      }
+    }
+  }
+
   if (!ctx || typeof ctx !== "object") {
     throw new MailHeloError("mail-helo/bad-input",
       "evaluate: ctx must be a plain object");

package/lib/mcp.js

@@ -648,10 +648,10 @@ function _validateValueAgainstSchema(value, schema, path) {
       // (a `(a+)+$` pattern blows up at ~40 input chars). Screen the tool
       // author's pattern through b.guardRegex so a ReDoS-shaped schema pattern
       // can't pin a CPU when matched against request input.
-      try { guardRegex().sanitize(schema.pattern, { profile: "strict" }); }
+      try { guardRegex().assertSafe(schema.pattern, path); }
       catch (_ge) { return path + ": schema pattern rejected as unsafe (ReDoS shape)"; }
       try {
-        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.sanitize (strict) above + input length-capped
+        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.assertSafe above + input length-capped
         if (!pat.test(value)) return path + ": does not match pattern";
       }
       catch (_e) { return path + ": invalid pattern in schema"; }

package/lib/middleware/bot-guard.js

@@ -54,6 +54,7 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 
@@ -64,7 +65,13 @@ var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 // constructing patterns dynamically compile at their own call site so
 // the pattern source is visible in their code.
 function _coerceAgentPattern(r, where) {
-  if (r instanceof RegExp) return r;
+  if (r instanceof RegExp) {
+    // Screen the operator's pattern for catastrophic-backtracking (ReDoS)
+    // shapes ONCE at create()-time — it is later .test()'d against the
+    // attacker-controlled User-Agent on every request.
+    guardRegex().assertSafe(r, where, BotGuardError, "bot-guard/unsafe-pattern");
+    return r;
+  }
   throw new BotGuardError("bot-guard/bad-pattern",
     where + " must be a RegExp instance; got " + (typeof r) +
     " (compile the pattern at the call site so the source is visible " +

package/lib/middleware/cors.js

@@ -52,6 +52,7 @@
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
@@ -237,6 +238,10 @@ function create(opts) {
       }
       origins.push({ kind: "string", canonical: canonEntry, original: entry });
     } else if (entry instanceof RegExp) {
+      // Screen the operator's RegExp once at create() time for
+      // catastrophic-backtracking (ReDoS) shapes before it ever runs
+      // .test() against an attacker-controlled Origin header per request.
+      guardRegex().assertSafe(entry, "middleware.cors: origins[" + oi + "]", CorsError, "cors/unsafe-pattern");
       origins.push({ kind: "regex", pattern: entry });
     } else {
       throw new CorsError("cors/bad-origin",

package/lib/middleware/request-log.js

@@ -29,6 +29,7 @@
  * for fully custom logic (e.g. "warn" only on slow-path requests).
  */
 var C = require("../constants");
+var guardRegex = require("../guard-regex");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 
@@ -95,6 +96,9 @@ function create(opts) {
     if (typeof skipPaths[i] !== "string" && !(skipPaths[i] instanceof RegExp)) {
       throw new Error("middleware.requestLog: skipPaths[" + i + "] must be a string prefix or RegExp");
     }
+    if (skipPaths[i] instanceof RegExp) {
+      guardRegex.assertSafe(skipPaths[i], "middleware.requestLog: skipPaths[" + i + "]");
+    }
   }
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;

package/lib/middleware/span-http-server.js

@@ -49,6 +49,7 @@ var { defineClass } = require("../framework-error");
 var SpanHttpError = defineClass("SpanHttpError", { alwaysPermanent: true });
 
 var observability = lazyRequire(function () { return require("../observability"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 function _shouldIgnore(path, ignorePaths) {
   if (!ignorePaths || !Array.isArray(ignorePaths)) return false;
@@ -177,6 +178,15 @@ function create(opts) {
   var tracer            = opts.tracer;
   var onEnd             = opts.onEnd || null;
   var ignorePaths       = opts.ignorePaths || null;
+  if (Array.isArray(ignorePaths)) {
+    for (var ip = 0; ip < ignorePaths.length; ip++) {
+      if (ignorePaths[ip] instanceof RegExp) {
+        guardRegex().assertSafe(ignorePaths[ip],
+          "middleware.spanHttpServer: ignorePaths[" + ip + "]",
+          SpanHttpError, "span-http/unsafe-pattern");
+      }
+    }
+  }
   var captureReqHeaders = opts.captureRequestHeaders || null;
   var captureResHeaders = opts.captureResponseHeaders || null;
   var spanNameFn        = opts.spanNameFn || null;

package/lib/request-helpers.js

@@ -49,6 +49,9 @@ var lazyRequire = require("./lazy-require");
 // required very early in the boot graph. Only touched at middleware-construction
 // time by trustedClientIp(), never on the hot path.
 var _ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
+// Lazy for the same boot-graph reason — only touched at middleware-construction
+// time by makeSkipMatcher() to screen operator-supplied skip RegExps for ReDoS.
+var _guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -991,6 +994,12 @@ function makeSkipMatcher(opts, label) {
       throw new TypeError(label + ": skipPaths[" + i + "] must be a string prefix or RegExp, got " +
         typeof skipPaths[i]);
     }
+    // Screen operator-supplied skip RegExps for catastrophic-backtracking
+    // shapes once at construction time — they later run .test() against
+    // attacker-controlled request paths on the hot path.
+    if (skipPaths[i] instanceof RegExp) {
+      _guardRegex().assertSafe(skipPaths[i], label + ": skipPaths[" + i + "]");
+    }
   }
   var skipFn = opts.skip;
   if (skipFn !== undefined && skipFn !== null && typeof skipFn !== "function") {

package/lib/self-update.js

@@ -54,6 +54,7 @@ var numericBounds = require("./numeric-bounds");
 var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
 var bCrypto = require("./crypto");
+var guardRegex = require("./guard-regex");
 var httpClient = require("./http-client");
 var safeJson = require("./safe-json");
 var { URL: NodeUrl } = require("node:url");
@@ -242,12 +243,25 @@ function _validatePollOpts(opts) {
         throw new SelfUpdateError("selfupdate/bad-asset-pattern",
           "selfUpdate.poll: opts.assetPattern must be a RegExp or string when present");
       }
+      // Screen an operator-supplied RegExp once at config-time; it is
+      // later .test()'d against attacker-controlled asset names in the
+      // request path, so a catastrophic-backtracking shape would be a
+      // per-request DoS. The string form is matched by substring
+      // (indexOf), never compiled, so it carries no ReDoS risk.
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: assetPattern",
+          SelfUpdateError, "selfupdate/unsafe-asset-pattern");
+      }
     },
     signaturePattern: function (value) {
       if (value !== undefined && !(value instanceof RegExp) && typeof value !== "string") {
         throw new SelfUpdateError("selfupdate/bad-sig-pattern",
           "selfUpdate.poll: opts.signaturePattern must be a RegExp or string when present");
       }
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: signaturePattern",
+          SelfUpdateError, "selfupdate/unsafe-sig-pattern");
+      }
     },
     maxBytes: function (value) {
       numericBounds.requirePositiveFiniteIntIfPresent(value,

package/lib/static.js

@@ -60,6 +60,7 @@ var observability = lazyRequire(function () { return require("./observability");
 // import cycles. Operators opt out via contentSafety: null (audited).
 var guardAll = lazyRequire(function () { return require("./guard-all"); });
 var guardFilename = lazyRequire(function () { return require("./guard-filename"); });
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var _err = StaticServeError.factory;
 
@@ -521,6 +522,13 @@ function _validateCreateOpts(opts) {
       if (value !== undefined && value !== null && !(value instanceof RegExp)) {
         throw errorClass.factory(code, "staticServe.create: hashedPathPattern must be a RegExp");
       }
+      // Screen the operator-supplied pattern once at create() time — it is
+      // .test()'d against the attacker-controlled request path on every
+      // download, so a catastrophic-backtracking (ReDoS) shape would be a
+      // per-request DoS. Reject the unsafe pattern at config time instead.
+      if (value instanceof RegExp) {
+        guardRegex().assertSafe(value, "staticServe: hashedPathPattern", StaticServeError, "static/unsafe-pattern");
+      }
     },
     // indexFile === null is the operator's "disable" sentinel; the helper
     // returns null/undefined unchanged so we keep that semantic.

package/lib/webhook-dispatcher.js

@@ -574,21 +574,41 @@ function dispatcher(opts) {
     await externalDb.query(stmt.sql, stmt.params);
   }
 
+  // FOR UPDATE SKIP LOCKED is Postgres / MySQL-only; sqlite is a single writer
+  // with no row lock. Decide on the NORMALIZED dialect — the same resolution the
+  // SQL builders use (_sqlDialect maps the `postgresql` alias to `postgres`) — so
+  // the lock decision can never disagree with the rendered SQL: a `postgresql`
+  // caller emits Postgres SQL AND row-locks, never Postgres SQL with the sqlite
+  // mark-then-reselect fallback (which would reopen the double-claim race).
+  function _supportsForUpdateSkipLocked() {
+    var d = _sqlDialect(externalDb);
+    return d === "postgres" || d === "mysql";
+  }
+
   // Claim due-pending deliveries by flipping them to 'in-flight' inside a
-  // transaction (mark-then-reselect; gated on status='pending' so two pollers
-  // can't both claim the same row), then attempt each claimed delivery.
+  // transaction, then attempt each claimed delivery. On Postgres / MySQL the
+  // SELECT row-locks the due rows via FOR UPDATE SKIP LOCKED, so concurrent
+  // retry pollers see DISJOINT sets — the rows this poller selected are exactly
+  // the rows it owns. sqlite (single writer, no row lock) falls back to a
+  // guarded mark-then-reselect: the UPDATE gated on status='pending' transitions
+  // each row once, and we re-read the in-flight rows we flipped. Without the
+  // SKIP LOCKED branch, two pollers under READ COMMITTED both reselect the same
+  // in-flight row (the loser's UPDATE matches zero rows, but the reselect-by-id
+  // re-reads the row the winner flipped) and double-deliver it in one cycle.
   async function processRetries() {
     await _reapStaleInflight();
     var dialect = _sqlDialect(externalDb);
+    var supportsSkipLocked = _supportsForUpdateSkipLocked();
     var claimed = await externalDb.transaction(async function (xdb) {
       var nowDate = _nowDate();
-      var sel = sql.select(deliveriesTable, { dialect: dialect })
+      var selBuilder = sql.select(deliveriesTable, { dialect: dialect })
         .columns(["delivery_id"])
         .whereRaw("status = 'pending'", [], { allowLiterals: true })
         .whereRaw("next_attempt_at <= ?", [nowDate])
         .orderBy("next_attempt_at")
-        .limit(batchSize)
-        .toExternalSql(dialect);
+        .limit(batchSize);
+      if (supportsSkipLocked) selBuilder.forUpdate({ skipLocked: true });
+      var sel = selBuilder.toExternalSql(dialect);
       var rows = await xdb.query(sel.sql, sel.params);
       var ids = ((rows && rows.rows) || []).map(function (r) { return r.delivery_id; });
       if (ids.length === 0) return [];
@@ -598,6 +618,12 @@ function dispatcher(opts) {
         .whereInArray("delivery_id", ids)
         .toExternalSql(dialect);
       await xdb.query(mark.sql, mark.params);
+      // Postgres / MySQL: the FOR UPDATE SKIP LOCKED SELECT already gave us an
+      // exclusively-locked, disjoint set, so the selected ids ARE our claim.
+      if (supportsSkipLocked) return ids;
+      // sqlite / other: no row lock, so re-read which rows WE flipped. The
+      // single writer serializes the gated UPDATE, so the in-flight rows in our
+      // id set are ours.
       var after = sql.select(deliveriesTable, { dialect: dialect })
         .columns(["delivery_id"])
         .whereRaw("status = 'in-flight'", [], { allowLiterals: true })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.38",
+  "version": "0.15.40",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:742c0889-e56f-4bee-8220-91a6cac8307b",
+  "serialNumber": "urn:uuid:4538b9a5-f7e6-4723-be61-b03f474f0c0e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-27T16:52:08.760Z",
+    "timestamp": "2026-06-28T06:47:43.444Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.38",
+      "bom-ref": "@blamejs/core@0.15.40",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.38",
+      "version": "0.15.40",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.38",
+      "purl": "pkg:npm/%40blamejs/core@0.15.40",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.38",
+      "ref": "@blamejs/core@0.15.40",
       "dependsOn": []
     }
   ]