@blamejs/core 0.15.54 → 0.15.56

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.56 (2026-06-29) — **Break-glass and dual-control wildcard scope matching is now segment-aware, and the JMAP cross-tenant gate validates every account-id argument (including `fromAccountId`), closing two authorization gaps.** Two authorization gates under-checked their input. b.breakGlass and b.dualControl matched a wildcard scope/role by stripping a trailing "*" and doing a raw string-prefix comparison (requireScope.indexOf(prefix) === 0), which ignores ":" segment boundaries — so a partial-segment grant like "phi:a*" satisfied a required "phi:admin", letting a holder break-glass-unseal or approve a flow they were not scoped for. Both now match through the canonical, segment-aware b.permissions.match, so only an exact scope or a whole-segment wildcard ("phi:*") satisfies the requirement. Separately, the JMAP server's cross-tenant gate validated only a method call's destination accountId, not the fromAccountId that /copy methods (Email/copy, CalendarEvent/copy — RFC 8620 §5.4) read their SOURCE account from — so an actor could name a foreign fromAccountId and copy another tenant's data. The gate now validates every account-id argument the call names. **Security:** *Break-glass / dual-control wildcard scope matching is segment-aware* — b.breakGlass grant (requireScope) and b.dualControl approval (approverRoles) matched a wildcard-shaped actor scope/role by stripping its trailing "*" and testing requireScope.indexOf(prefix) === 0 — a raw string prefix that ignores the ":" segment structure. A partial-segment grant therefore over-matched: "phi:a*" satisfied "phi:admin" (and "p*" satisfied any "phi:..."), so an actor with a narrower grant could break-glass-unseal sealed data or approve a dual-control flow they were not authorized for. Both sites now match through b.permissions.match, where "*" must occupy a whole ":"-delimited segment — "phi:*" still satisfies "phi:admin", but "phi:a*" does not. Actor scopes/roles flow from operator-trusted assignment, so this tightens a defense-in-depth gate rather than a request-controlled bypass. · *JMAP cross-tenant gate validates every account-id argument, not only the destination* — The JMAP server rejects a method call that names an accountId outside the actor's enumerated set (RFC 8620 §3.6.1). It checked only accountId, but /copy methods (Email/copy, CalendarEvent/copy — RFC 8620 §5.4) also carry fromAccountId, the SOURCE account they read from. An actor enumerated for their own destination account could therefore name a foreign fromAccountId and have the operator's copy handler read another tenant's messages. The gate now validates every account-id argument (any *AccountId) against the actor's enumerated accounts before the handler runs, so a foreign source account is refused with accountNotFound. **Detectors:** *Scope/role wildcard matching must use b.permissions.match* — A codebase-patterns detector flags the hand-rolled wildcard idiom (a trailing-"*" check plus a slice(0,-1) strip plus a raw indexOf(prefix)===0 prefix match), so a new authorization gate cannot reintroduce a segment-unaware scope match instead of routing through b.permissions.match.
+
+- v0.15.55 (2026-06-29) — **`b.fileUpload` enforces per-upload ownership: acceptChunk / finalize / status / cancelUpload now refuse a caller who is not the upload's owner, closing an IDOR.** A file-upload manager recorded the owner of each upload at init() but never checked it again: acceptChunk, finalize, status, and cancelUpload looked the upload up by the caller-supplied uploadId alone. The only gate was the coarse "fileUpload.<op>" permission scope, which says whether an actor may perform the operation at all — not whether they own the specific upload. So any caller holding the (commonly shared) fileUpload.finalize / cancel / status / accept scope could finalize, cancel, read the status of, or push chunks into another actor's in-flight upload by its uploadId (an insecure-direct-object-reference, CWE-639). Each lifecycle method now compares the calling actor against the stored owner (actor.id || actor.userId, captured at init) and refuses a non-owner. Operator admin tooling that must act across actors opts in with create({ allowCrossActor: true }); when a permissions instance is wired, cross-actor access additionally requires the new "fileUpload.admin" scope, so the escape hatch is itself gated. Uploads created without an actor are owned by the anonymous identity and unreachable by a named actor (fail-closed). **Security:** *File-upload lifecycle methods enforce per-upload ownership (IDOR fix)* — acceptChunk, finalize, status, and cancelUpload previously authorized only against the coarse fileUpload.<op> capability scope, never against the upload's recorded owner, so a caller with that scope could act on any actor's upload by guessing or enumerating its uploadId. Each method now refuses a caller whose identity (actor.id || actor.userId) does not match the owner stored at init() — raising fileUpload OWNERSHIP_VIOLATION — so an upload is reachable only by the actor that created it. Cross-actor admin tooling opts in via create({ allowCrossActor: true }) plus the new fileUpload.admin permission scope (required when permissions are wired); list({ scopeToActor: false }) remains the deliberate cross-actor listing view. Operators whose workflows legitimately hand an upload between actors must set allowCrossActor and grant fileUpload.admin to the acting principal. **Detectors:** *fileUpload lifecycle methods must enforce ownership* — A codebase-patterns detector flags any fileUpload lifecycle method that loads an upload by a request-supplied uploadId without calling the ownership check before acting, so a newly added method cannot silently reintroduce the IDOR.
+
 - v0.15.54 (2026-06-28) — **SAML federation-metadata (MDQ) verification binds the signature to the consumed EntityDescriptor and refuses signature-wrapping, closing an IdP trust-anchor takeover.** b.auth.saml.fetchMdq validates signed federation metadata with the same XML-dsig verifier the assertion path uses, but discarded the verified reference and never bound it to the EntityDescriptor the operator consumes — unlike verifyResponse, which already enforces that the signature covers the element it trusts. Combined with a first-child Signature lookup, an attacker controlling or interposing on the MDQ source could wrap a genuinely federation-signed EntityDescriptor under a forged container (or bury it in an EntityDescriptor whose own ID and signing certificate are attacker-chosen): the signature still validated over the buried element, fetchMdq returned the whole document, and the operator extracted the attacker's certificate as the IdP signing key — a full SAML authentication bypass (the CVE-2024-45409 / ruby-saml signature-wrapping class). fetchMdq now requires the metadata root to be a single EntityDescriptor, binds the verified reference to that root's ID (mirroring verifyResponse), confirms the signed entityID is the one requested, and refuses a duplicate top-level Signature. **Security:** *fetchMdq binds the federation signature to the consumed EntityDescriptor (XML signature-wrapping defense)* — On the MDQ trust-bootstrap path, fetchMdq verified the federation signature but discarded the reference it covered, so the signature did not have to cover the EntityDescriptor whose signing certificate the operator subsequently trusts. An attacker with a malicious or interposed MDQ responder could pair a genuine federation signature over a buried entity with a forged outer/sibling EntityDescriptor carrying their own signing certificate; fetchMdq accepted and returned the wrapped document, and the operator installed the attacker certificate as the IdP trust anchor — forging arbitrary assertions thereafter. fetchMdq now refuses a non-EntityDescriptor root (the EntitiesDescriptor wrapper), refuses a duplicate top-level Signature, binds the verified reference to the document-root EntityDescriptor's ID, and confirms the signed entityID matches the requested one — mirroring the wrapping defenses verifyResponse already applies to assertions. New error codes: auth-saml/mdq-not-entity-descriptor, auth-saml/mdq-duplicate-signature, auth-saml/mdq-entity-mismatch (plus the existing auth-saml/signed-different-element for a buried-reference root). Verification of legitimately signed single-entity metadata is unchanged.
 
 - v0.15.53 (2026-06-28) — **DKIM (and ARC) verification refuses a body-length-limited (`l=`) signature once content has been appended past the signed octets, closing the append-after-signature attack.** A DKIM signature with an `l=` body-length tag covers only the first `l=` octets of the canonicalized body, so anyone in the delivery path can append arbitrary unsigned content after the signed prefix and the body hash still matches. b.mail.dkim.verify honored such a signature and returned `pass`, with only a non-load-bearing warning that no consumer read — so b.mail.inbound.verify granted an aligned DMARC `pass` to a message whose delivered body diverged from the signed bytes (RFC 6376 §8.2). Verification now refuses an `l=` signature once the delivered body extends beyond the signed octets: the verified prefix no longer authenticates the appended content, so the result is a body-hash `fail` rather than a `pass`. Signatures whose `l=` exactly covers the body (no appended content) are unchanged, and an operator who must accept legacy `l=` senders can opt back in with verify({ acceptBodyLengthLimit: true }). ARC-Message-Signature verification, which reuses the same verifier, inherits the refusal unconditionally. **Security:** *DKIM verify refuses an l= signature with content appended past the signed octets* — The DKIM `l=` tag (RFC 6376 §3.5) limits the body hash to the first `l=` canonicalized octets, leaving any trailing body unsigned — the documented append-after-signature exposure (RFC 6376 §8.2). b.mail.dkim.verify hashed the prefix, matched `bh=`, and returned `pass` for the whole message, even though the recipient received appended content the signer never authenticated; the only signal was a warning string that b.mail.inbound.verify / dmarc.evaluate never inspected, so a forged trailer rode an aligned DMARC `pass`. verify now returns a body-hash `fail` when an `l=` signature leaves delivered body content beyond the signed octets (the framework already refuses `l=` at sign time). A signature whose `l=` covers the entire body still verifies; verify({ acceptBodyLengthLimit: true }) restores the prior accept-with-warning behavior for operators with legacy `l=` senders. · *ARC-Message-Signature verification inherits the same refusal* — ARC chain validation verifies each hop's ARC-Message-Signature through the same DKIM verifier, so an AMS carrying `l=` with appended content is now refused as a body-hash `fail` — failing the chain — rather than validating over a prefix. The ARC path does not expose the acceptBodyLengthLimit opt-out, so it is unconditionally fail-closed for an appended-content `l=`.

package/lib/break-glass.js

@@ -58,6 +58,7 @@ var vault = lazyRequire(function () { return require("./vault"); });
 
 var lockout = lazyRequire(function () { return require("./auth/lockout"); });
 var passkey = lazyRequire(function () { return require("./auth/passkey"); });
+var permissions = lazyRequire(function () { return require("./permissions"); });
 
 // Errors — all 14 codes documented in the spec. `permanent: true`
 // means caller's input is bad (config-time / call-site reject);
@@ -1055,16 +1056,14 @@ async function grant(opts) {
         : []);
     var scopeOk = false;
     for (var sci = 0; sci < actorScopes.length; sci += 1) {
-      if (actorScopes[sci] === policy.requireScope) { scopeOk = true; break; }
-      // Wildcard support: "phi:*" matches "phi:admin" and "phi:read".
+      // Segment-aware scope match via the canonical b.permissions.match: an
+      // exact scope, or a wildcard whose "*" occupies a WHOLE colon segment
+      // ("phi:*" → "phi:admin"), satisfies the requirement. A raw string prefix
+      // ("phi:admin".indexOf("phi:a") === 0) wrongly let a partial-segment
+      // scope ("phi:a*") glass-unseal a different value.
       if (typeof actorScopes[sci] === "string" &&
-          actorScopes[sci].length > 0 &&
-          actorScopes[sci].charAt(actorScopes[sci].length - 1) === "*") {
-        var prefix = actorScopes[sci].slice(0, -1);
-        if (typeof policy.requireScope === "string" &&
-            policy.requireScope.indexOf(prefix) === 0) {
-          scopeOk = true; break;
-        }
+          permissions().match(actorScopes[sci], policy.requireScope)) {
+        scopeOk = true; break;
       }
     }
     if (!scopeOk) {

package/lib/dual-control.js

@@ -38,6 +38,7 @@ var C = require("./constants");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var permissions = lazyRequire(function () { return require("./permissions"); });
 
 var DualControlError = defineClass("DualControlError", { alwaysPermanent: true });
 var _err = DualControlError.factory;
@@ -222,22 +223,15 @@ function create(opts) {
     if (!actor || !Array.isArray(actor.roles)) return false;
     for (var i = 0; i < approverRoles.length; i++) {
       var required = approverRoles[i];
-      // Wildcard match — actor's "security:*" satisfies a required
-      // "security:officer" (matching the b.permissions.match
-      // semantics elsewhere in the framework). Without this, an
-      // operator with a wildcard-shaped role can't approve dual-
-      // control flows even when b.permissions would consider the
-      // role assignment satisfied.
       for (var j = 0; j < actor.roles.length; j++) {
-        var actorRole = actor.roles[j];
-        if (actorRole === required) return true;
-        if (typeof actorRole === "string" &&
-            actorRole.length > 0 &&
-            actorRole.charAt(actorRole.length - 1) === "*") {
-          var prefix = actorRole.slice(0, -1);
-          if (typeof required === "string" && required.indexOf(prefix) === 0) {
-            return true;
-          }
+        // Segment-aware role match via the canonical b.permissions.match: an
+        // exact role, or a wildcard whose "*" occupies a WHOLE colon segment
+        // ("security:*" → "security:officer"), satisfies the requirement. A raw
+        // string prefix ("security:officer".indexOf("security:o") === 0)
+        // wrongly let a partial-segment role ("security:o*") approve a flow.
+        if (typeof actor.roles[j] === "string" &&
+            permissions().match(actor.roles[j], required)) {
+          return true;
         }
       }
     }

package/lib/file-upload.js

@@ -129,9 +129,12 @@
  * Design posture:
  *
  *   - **init() before any chunk**: explicit lifecycle. Init records
- *     createdAt + actor + metadata + signing key in a per-upload sidecar
- *     so subsequent acceptChunk / finalize / status calls can authenticate
- *     and audit consistently.
+ *     createdAt + actor + metadata in a per-upload sidecar; the stored owner
+ *     (actor.id || actor.userId) is enforced on every subsequent acceptChunk /
+ *     finalize / status / cancelUpload call, so one actor cannot act on another
+ *     actor's upload by its uploadId. Operator admin tooling opts into
+ *     cross-actor access via allowCrossActor (default off) plus the
+ *     "fileUpload.admin" permission scope.
  *
  *   - **Framework owns chunk lifecycle**, not final storage. Operator
  *     decides via `onFinalize` what to do with the assembled buffer
@@ -305,6 +308,16 @@ function _validateCreateOpts(opts) {
       validateOpts.optionalObjectWithMethod(v, "check", label, FileUploadError, "BAD_OPT",
         "must be a b.permissions instance (check fn)");
     },
+    // allowCrossActor — escape hatch for operator admin tooling that must act on
+    // ANY actor's upload (ops dashboards, cleanup jobs). Default false: per-upload
+    // ownership is enforced so actor B cannot finalize / cancel / status /
+    // acceptChunk actor A's upload by guessing its uploadId. When true the
+    // ownership check is skipped; if a permissions instance is also wired the
+    // caller must additionally hold the "fileUpload.admin" scope, so cross-actor
+    // access stays gated.
+    allowCrossActor: function (v, label) {
+      validateOpts.optionalBoolean(v, label, FileUploadError, "BAD_OPT");
+    },
     // contentSafety — extension-keyed gate map for per-extension content
     // validation. Default behaviour: when undefined, the framework wires
     // b.guardAll.byExtension({ profile: "strict" }) automatically so every
@@ -383,6 +396,7 @@ function _validateCreateOpts(opts) {
  *   audit:                     b.audit,
  *   observability:             b.observability,
  *   permissions:               b.permissions,          // optional; gates init/accept/finalize/status/list/cancel
+ *   allowCrossActor:           boolean,                // default false; admin escape hatch — bypasses per-upload ownership when the caller holds the "fileUpload.admin" scope
  *   fileType:                  b.fileType,             // required when allowedFileTypes is non-empty
  *   contentSafety:             Object | null,          // ext→gate map; null = audited opt-out; undefined = b.guardAll.byExtension({ profile: "strict" })
  *   filenameSafety:            Object | null,          // gate; null = audited opt-out; undefined = b.guardFilename.gate({ profile: "strict" })
@@ -415,6 +429,7 @@ function create(opts) {
   var onChunk                 = opts.onChunk || null;
   var fileType                = opts.fileType || null;
   var permissions             = opts.permissions || null;
+  var allowCrossActor         = opts.allowCrossActor === true;
   // ---- Default-on safety wiring ----
   // contentSafety: undefined → wire b.guardAll.byExtension({ profile: "strict" })
   // contentSafety: null      → explicit opt-out, audit row emitted
@@ -547,6 +562,60 @@ function create(opts) {
     }
   }
 
+  // _checkOwnership — refuse when the calling actor does not own the upload.
+  // Owner identity is the same _actorKey derivation init() stored in
+  // meta.actorId (actor.id || actor.userId || "_anonymous"), so an anonymous
+  // upload is owned by "_anonymous" and a named actor cannot reach it (and vice
+  // versa) — fail-closed for the missing/legacy-meta case. The permission-scope
+  // check ("fileUpload.<op>") is a coarse capability ("may this actor finalize
+  // uploads AT ALL"); this is the per-resource authorization ("does this actor
+  // own THIS upload"). Both run on every lifecycle method, so one actor cannot
+  // act on another's upload by guessing its uploadId (IDOR / CWE-639).
+  //
+  // Escape hatch: allowCrossActor (create-time, default off) skips the ownership
+  // comparison for operator admin tooling; when permissions are also wired,
+  // "fileUpload.admin" is required so cross-actor access is itself gated.
+  function _checkOwnership(action, actor, meta) {
+    if (!meta) return;   // not-found is handled by the caller's own UNKNOWN_UPLOAD path
+    var callerKey = _actorKey(actor);
+    if (meta.actorId === callerKey) return;   // the owner always passes
+    // The caller is NOT the owner. Refuse unless the operator enabled
+    // cross-actor admin access at create() — and, when permissions are wired,
+    // the caller holds the "fileUpload.admin" scope (so the escape hatch is
+    // itself gated and a non-owner cannot ride allowCrossActor without it).
+    if (allowCrossActor) {
+      var adminOk = !permissions;   // scope-less single-tenant operator: allowCrossActor alone suffices
+      if (permissions) {
+        try { adminOk = permissions.check(actor, "fileUpload.admin"); }
+        catch (_e) { adminOk = false; }
+      }
+      if (adminOk) return;
+      _emitObs("fileUpload.permission_denied", 1, { action: "admin" });
+      _emitAudit("fileUpload." + action, {
+        actor:    requestHelpers.extractActorContext(actor),
+        resource: { kind: "fileUpload", id: meta.uploadId },
+        outcome:  "denied",
+        reason:   "cross-actor-admin-scope-required",
+        metadata: { uploadId: meta.uploadId, owner: meta.actorId,
+                    caller: callerKey, action: action },
+      });
+      throw _err("PERMISSION_DENIED",
+        "fileUpload." + action + ": cross-actor access requires scope 'fileUpload.admin'");
+    }
+    _emitObs("fileUpload.ownership_violation", 1, { action: action });
+    _emitAudit("fileUpload." + action, {
+      actor:    requestHelpers.extractActorContext(actor),
+      resource: { kind: "fileUpload", id: meta.uploadId },
+      outcome:  "denied",
+      reason:   "ownership-violation",
+      metadata: { uploadId: meta.uploadId, owner: meta.actorId,
+                  caller: callerKey, action: action },
+    });
+    throw _err("OWNERSHIP_VIOLATION",
+      "fileUpload." + action + ": actor does not own upload '" + meta.uploadId +
+      "' (ownership enforced; set allowCrossActor + 'fileUpload.admin' scope for admin tooling)");
+  }
+
   function _readReceivedIndices(uploadId) {
     var p = _receivedPath(uploadId);
     if (!nodeFs.existsSync(p)) return [];
@@ -699,6 +768,7 @@ function create(opts) {
       throw _err("UNKNOWN_UPLOAD",
         "fileUpload.acceptChunk: no init() seen for '" + uploadId + "'; call init() first");
     }
+    _checkOwnership("accept", actor, meta);
     if (clock() - meta.lastChunkAt > maxIdleMs) {
       // Idle-timed-out — too much time since init or last chunk.
       throw _err("UPLOAD_IDLE_EXPIRED",
@@ -991,6 +1061,7 @@ function create(opts) {
       throw _err("UNKNOWN_UPLOAD",
         "fileUpload.finalize: no init() seen for '" + uploadId + "'");
     }
+    _checkOwnership("finalize", actor, meta);
 
     _validateManifest(manifest);
 
@@ -1216,6 +1287,7 @@ function create(opts) {
     _checkPermission("status", callerOpts.actor);
     var meta = _readMeta(uploadId);
     if (!meta) return null;
+    _checkOwnership("status", callerOpts.actor, meta);
     var indices = _readReceivedIndices(uploadId).slice().sort(function (a, b) { return a - b; });
     return {
       uploadId:           uploadId,
@@ -1258,6 +1330,7 @@ function create(opts) {
     _checkPermission("cancel", callerOpts.actor);
     var meta = _readMeta(uploadId);
     if (!meta) return { ok: false, uploadId: uploadId, reason: "not-found" };
+    _checkOwnership("cancel", callerOpts.actor, meta);
     try { nodeFs.rmSync(_uploadDir(uploadId), { recursive: true, force: true }); }
     catch (_e) { /* best-effort */ }
     _emitObs("fileUpload.cancelled", 1);

package/lib/mail-server-jmap.js

@@ -395,18 +395,28 @@ function create(opts) {
             description: "Method '" + methodName + "' not implemented on this server" }, clientId]);
         continue;
       }
-      // Cross-tenant gate (RFC 8620 §3.6.1): if the call names an accountId,
-      // it MUST be one the actor is enumerated for. Rejected BEFORE the
-      // operator handler runs so a forged/foreign accountId never reaches
-      // the backend. Calls without an accountId (account-agnostic methods)
-      // pass through unchanged.
-      if (resolvedArgs && typeof resolvedArgs === "object" &&
-          resolvedArgs.accountId !== undefined && resolvedArgs.accountId !== null) {
-        var callAccountId = resolvedArgs.accountId;
-        if (typeof callAccountId !== "string" || !permittedAccounts[callAccountId]) {
+      // Cross-tenant gate (RFC 8620 §3.6.1): EVERY account-id argument the call
+      // names MUST be one the actor is enumerated for — not only `accountId`
+      // but also `fromAccountId` on /copy methods (Email/copy, CalendarEvent/copy
+      // — RFC 8620 §5.4), whose SOURCE account is read from. Checking only the
+      // destination accountId let a /copy name a foreign fromAccountId and copy
+      // (read) another tenant's data. Rejected BEFORE the operator handler runs.
+      // Account-agnostic methods (no *AccountId arg) pass through unchanged.
+      if (resolvedArgs && typeof resolvedArgs === "object") {
+        var argKeys = Object.keys(resolvedArgs);
+        var deniedAccountId; var deniedHit = false;
+        for (var aki = 0; aki < argKeys.length && !deniedHit; aki += 1) {
+          if (!/[Aa]ccountId$/.test(argKeys[aki])) continue;       // accountId, fromAccountId, ...
+          var accVal = resolvedArgs[argKeys[aki]];
+          if (accVal === undefined || accVal === null) continue;
+          if (typeof accVal !== "string" || !permittedAccounts[accVal]) {
+            deniedHit = true;
+            deniedAccountId = typeof accVal === "string" ? accVal : null;
+          }
+        }
+        if (deniedHit) {
           _emit("mail.server.jmap.account_not_found",
-            { method: methodName, accountId: typeof callAccountId === "string" ? callAccountId : null,
-              clientId: clientId }, "denied");
+            { method: methodName, accountId: deniedAccountId, clientId: clientId }, "denied");
           methodResponses.push(["error",
             { type: "urn:ietf:params:jmap:error:accountNotFound",
               description: "accountId is not accessible to this actor" }, clientId]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.54",
+  "version": "0.15.56",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:00e2fd44-d9a2-420d-b06b-b0f089269b4b",
+  "serialNumber": "urn:uuid:e0d3a558-1b7f-49b9-834a-79543f884cc8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-29T07:08:19.605Z",
+    "timestamp": "2026-06-29T09:06:18.938Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.54",
+      "bom-ref": "@blamejs/core@0.15.56",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.54",
+      "version": "0.15.56",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.54",
+      "purl": "pkg:npm/%40blamejs/core@0.15.56",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.54",
+      "ref": "@blamejs/core@0.15.56",
       "dependsOn": []
     }
   ]