@blamejs/core 0.16.20 → 0.16.21

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.21 (2026-07-12) — **Bind the declared JWS/HTTP-signature algorithm to the key's real type across b.auth.jwt and b.crypto.httpSig (closing an algorithm-confusion allowlist bypass), refuse a JWT whose payload is not a JSON object in b.guardJwt, and enforce the SAML InResponseTo replay check on the holder-of-key confirmation.** Covering untested adversarial branches across the token and assertion verifiers surfaced a set of fail-open auth defects, fixed at the root. b.auth.jwt.verify gated its algorithm allowlist on the self-declared JWS alg header while node:crypto verified against the key's intrinsic type, so a token signed by an ML-DSA key but declaring a SLH-DSA alg passed a SLH-only allowlist and verified against the ML-DSA key -- a full algorithm-allowlist bypass (CWE-347). The declared alg is now bound to the key's real type at both sign and verify. The same class existed unenforced in b.crypto.httpSig (a peer could sign with a classical ed25519 key while declaring the PQC alg ml-dsa-65, emitting an authenticated but false PQC-signed label); it now binds the alg to the key's type at sign and verify too. b.guardJwt skipped its entire claim-sanity block (required-claims + exp/nbf/iat) when the payload did not decode to a JSON object, so a token carrying no readable claims set was admitted at strict; a non-object payload is now refused symmetrically with the header. And b.auth.saml validated InResponseTo on the Bearer subject-confirmation but not the holder-of-key one, silently dropping an operator's replay binding on every HoK assertion; the holder-of-key path now applies the identical check. **Security:** *b.auth.jwt binds the declared algorithm to the key's real type (algorithm-confusion bypass)* — verify() constrained the algorithm allowlist against the self-declared JWS `alg` header -- a value the token issuer controls -- while node:crypto.verify(null, ...) selects the actual algorithm from the KeyObject's intrinsic type. The two could diverge: a token signed by an ML-DSA-87 key but declaring alg="SLH-DSA-SHAKE-256f" passed an SLH-only allowlist and was verified against the ML-DSA public key, and sign() could emit a token whose header alg misstated its own signing algorithm -- the exact mislabeled artifact the verify bypass consumes (CWE-347 algorithm confusion). Both sign() and verify() now assert the declared alg matches the resolved key's asymmetricKeyType, so the allowlist genuinely constrains which algorithm authenticated the token; a matched alg/key round-trip is unaffected. · *b.crypto.httpSig binds the declared algorithm to the key's real type* — HTTP Message Signature sign() and verify() validated the declared `alg` against the supported set but never bound it to the key's type -- so a peer could sign with a classical ed25519 key while declaring the post-quantum alg ml-dsa-65 (an authenticated but false PQC-signed label a verifier trusting the label would honor), the same algorithm-confusion class. sign() now refuses to emit a token whose alg misstates the private key's type, and verify() refuses -- before the crypto check -- a resolved key whose type differs from the declared alg. Legitimate ed25519 and ml-dsa-65 round-trips are unaffected. · *b.guardJwt refuses a JWT whose payload is not a JSON object* — The guard skipped its entire payload claim-sanity block -- required-claims and exp/nbf/iat -- whenever the payload segment did not decode to a JSON object (undecodable base64url, non-JSON bytes, a JSON primitive, or a JSON array), so a token carrying no readable claims set was admitted at the strict profile (validate returned ok and gate returned serve), defeating the guard's advertised missing-claim refusals. A non-object payload is now refused with a high-severity payload-decode finding, symmetric with the header-decode path, at every profile. · *b.auth.saml enforces the InResponseTo replay check on holder-of-key confirmations* — verifyResponse validated the SubjectConfirmationData InResponseTo against the expected AuthnRequest ID on the Bearer confirmation path but not the holder-of-key one, so an operator that opted into InResponseTo binding (solicited-response / replay correlation) silently lost it on every holder-of-key assertion -- a HoK assertion with a mismatched or absent InResponseTo was accepted, and the returned value was hardcoded to null. The holder-of-key path now applies the identical constant-time InResponseTo check the Bearer path uses and echoes the validated value, so the replay binding holds on both confirmation methods.
+
 - v0.16.20 (2026-07-12) — **Make the ClamAV scan-verdict classifier fail closed on a coalesced infected+clean reply, refuse a session under a strict device-binding threshold when the anomaly score can't be computed, guard the MessageFormat select renderer against prototype-chain keys, and reject a non-canonical webhook timestamp.** Covering untested adversarial branches across the mail scanner, the session device-binding verifier, the i18n message renderer, and the webhook verifier surfaced a set of fail-open and correctness defects, fixed at the root. The mail scanner's ClamAV INSTREAM reply classifier tested the benign OK token before the malign FOUND token, so a reply carrying both (a coalesced or stale-then-fresh reply on a reused connection) resolved to clean and delivered an infected message; the classifier now tests FOUND, then ERROR, then OK, so a malign signal always dominates and only an OK with no FOUND/ERROR is clean. Session verification under a strict maxAnomalyScore device-binding policy admitted a relocated device whenever no decisive anomaly score could be produced (no scorer supplied, or a scorer that threw or returned a non-finite value) -- it now fails closed, matching the unreadable-binding discipline. The ICU-style MessageFormat select renderer looked up an end-user-supplied select value with a bare object index, so a value naming an Object.prototype member (__proto__ / constructor / toString) returned an inherited member and either rendered garbage or threw a render-time DoS; every case lookup is now own-property only. And the webhook verifier accepted any string that Number() maps to the signed timestamp (scientific, trailing .0, hex, leading zero/plus), making the authenticated t= field malleable; it now requires the canonical decimal. **Fixed:** *b.webhook verifier rejects a non-canonical authenticated timestamp* — The verifier parsed the authenticated t= field with Number() and validated only the post-coercion integer, then re-composed the signed string from that integer -- so any string Number() maps to the same value (scientific 1.7e9, a trailing .0, hex 0x..., a leading zero/plus/whitespace) re-canonicalized into the identical signed string and verified, making the authenticated timestamp field malleable. The verifier now also requires the raw bytes to equal the canonical decimal the signer emits, the same strict digits-only parse the Stripe-compatible verifier already applied; the only legitimate producer (b.webhook.signer) emits the canonical form, so there is no interop cost. · *b.i18n.dir honors a custom RTL language configured in any case* — dir() folds the requested locale's primary subtag to lower case before the RTL-membership test, but a custom rtlLanguages list was stored verbatim, so an operator-supplied entry like "AR" or "CKB" never matched the lower-cased lookup and the language rendered left-to-right. The configured list is now folded to lower case the same way the lookup is, so a custom RTL entry matches regardless of case. · *b.i18n.t resolves a leaf shadowed by a namespace in a more-specific locale* — The fallback-chain lookup returned the first locale where the dotted key resolved to any non-undefined value, including a nested namespace object -- so a namespace at that path in the requested locale halted the chain and shadowed a real translation leaf defined in a fallback locale, leaking the raw key into the UI (and has() reported false). The lookup now treats only a renderable leaf (a string or a plural-shaped object) as a hit and keeps walking the chain past a namespace object, so a leaf in a fallback locale resolves. **Security:** *b.mail.scan fails closed on a coalesced infected+clean ClamAV reply* — The ClamAV INSTREAM reply classifier tested the benign `stream: OK` token before the malign `... FOUND` token, so a reply that carried both -- a coalesced or stale-then-fresh reply on a reused connection, or an intermediary that concatenates two responses -- resolved to a clean verdict and delivered an infected message (a scan bypass). The classifier is a security verdict, so it now tests FOUND (infected) first, then ERROR (do-not-deliver), then OK (clean); an unrecognized shape is still an error. A reply containing a FOUND signal can no longer be downgraded to clean by an adjacent OK token. · *b.session.verify fails closed under a strict anomaly threshold when the score can't be computed* — Under the strict maxAnomalyScore device-binding policy, verify() only assigned a fingerprint anomaly score when the supplied scorer returned a finite number. With no scorer (the option is documented as pairing with one but is omittable), or a scorer that threw or returned a non-finite value, the score stayed null and the refusal guard (score present AND above threshold) was false, so verify RETURNED a session bound to one device when presented from another. An uncomputable anomaly score on genuine fingerprint drift now fails closed (verify returns null), matching the fail-closed discipline the unreadable-binding branch already applied; the legitimate path (a finite score at or below the threshold admits, with the score surfaced) is unchanged. · *b.i18n MessageFormat select renderer guards against prototype-chain keys* — The ICU-style MessageFormat select renderer resolved a case with a bare object index on an end-user-supplied select value, so a value naming an Object.prototype member -- __proto__ / constructor / toString / hasOwnProperty / valueOf -- returned a truthy INHERITED member, bypassing the `other` fallback: an inherited value with no length rendered as empty (silent output corruption), and an inherited function threw when rendered as a non-array (a request-level DoS). Every select/plural case lookup is now own-property only, so an attacker-supplied select value that names a prototype member falls through to the `other` case. **Detectors:** *MessageFormat case lookups must be own-property* — A structural check asserts that the MessageFormat renderer resolves a select/plural case through the own-property helper rather than a bare object index, so an end-user-supplied select value can never reach the prototype chain and re-open the corruption/DoS class.
 
 - v0.16.19 (2026-07-12) — **Close a family of entity- and whitespace-hidden dangerous-URL-scheme and CSS-injection bypasses across b.guardHtml / b.guardSvg / b.guardMarkdown behind one shared normalizer, bound a DNS decompression-pointer name bomb, refuse an ambiguous audit-anchor canonicalization, and stop an empty-string sealed field from crashing an AAD-table write.** Covering untested adversarial branches across the content guards, a DNS wire parser, the audit-log anchor, and the sealed-field codec surfaced a family of fail-open defects, fixed at the root. The most serious span the content-guard URL-scheme and CSS-injection denylists: a browser removes tab/lf/cr from anywhere in a URL and trims a leading/trailing control-or-space run before resolving the scheme, and character-reference-decodes a style attribute before the CSS parser sees it, so an entity-encoded tab, an entity-encoded leading space, an HTML named entity, or an entity-encoded CSS token could all navigate/execute while reading past a denylist that matched the raw bytes. b.guardHtml missed the whitespace normalization entirely and matched CSS against raw bytes; b.guardMarkdown decoded only numeric entities; b.guardSvg had a partial fix. All three now route their scheme and CSS-token checks through one pair of shared codepoint-class normalizers, so no guard can strip a different set of encodings than another. A DNS compression-pointer chain could decompress a single name past the RFC 1035 255-octet / label caps (a decompression-amplification DoS); the audit-log anchor's newline-delimited signed bytes let one signature validate for several different tip/previous-tip splits (defeating the linkage tamper-evidence); an SVG animation element permitted under a permissive profile lost its open tag; and an empty-string sealed column crashed an AAD-table insert. **Fixed:** *b.guardSvg preserves a profile-permitted safe animation element* — Under a permissive profile that allows animation, a safe animation element (for example an <animate> whose attributeName targets a visual property) had its open tag dropped while its end tag was still emitted, leaving an orphan close tag and silently stripping an element the profile permits. The sanitize path now affirmatively re-permits the safe-target case; an unsafe-target animation (attributeName=href and similar) is still dropped and neutralized. · *b.cryptoField.sealRow seals an empty-string field as a tamper-evident envelope* — sealRow dispatched every non-null value -- including an empty string -- to one of three envelope-seal branches that disagreed on empty plaintext: the plain and per-row-key branches handled it, but the AAD branch is fail-closed and threw, so a write to an AAD-sealed table whose sealed column held an empty string crashed the insert. An empty string now encodes to a non-empty typed marker before sealing, so it becomes a real authenticated envelope (never a bare plaintext empty string) that round-trips to an empty string on read. On the read side, a bare empty string found in an AAD-bound or per-row-key sealed column -- which after this change can only be an envelope-downgrade by a DB-write attacker -- fails closed (the cell is nulled and audited) instead of being accepted as a valid empty value, so the sealed-column tamper-evidence guarantee holds for empty values too. **Security:** *b.guardHtml / b.guardSvg / b.guardMarkdown refuse entity- and whitespace-hidden dangerous URL schemes* — The URL-scheme denylist on every URL-bearing attribute (href / xlink:href / markdown link, image, autolink, reference-definition) is resolved after normalizing the value the way a browser does: character-reference decoding (numeric AND the HTML5 named-entity ASCII subset browsers honor, e.g. &Tab; / &colon;), removing tab/lf/cr from anywhere, and trimming a leading/trailing C0-control-or-space run. Previously b.guardHtml stripped neither tab/lf/cr nor an entity-encoded leading space, and b.guardMarkdown decoded only numeric entities, so payloads such as java&#9;script:, java&Tab;script:, and &#32;javascript: resolved to an empty scheme and were served/rendered as safe while a browser executed them as javascript:. The normalization now lives in two shared codepoint-class primitives (b.codepointClass.decodeMarkupEntities and b.codepointClass.stripUrlSchemeWhitespace) that all three guards compose, so no guard can fold away a different set of encodings than another. · *b.guardHtml / b.guardSvg detect entity-encoded and whitespace-hidden CSS injection in style attributes* — A style attribute is HTML/XML character-reference-decoded before the CSS parser sees it, so width:ex&#x70;ression(, background:url(&#x6A;avascript:...), and behavior&colon;url(...) reach CSS as expression( / url(javascript:...) / behavior: with no literal danger token in the raw bytes. The CSS-danger check matched the raw attribute value, so these bypassed the denylist and were served verbatim (a stored CSS-injection XSS). Both guards now match the entity-decoded value AND fold the URL-scheme whitespace a browser strips inside url(...) (tab / lf / cr), so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:) reaching CSS as url(java<TAB>script:), which navigates as javascript:) can no longer defeat the contiguous javascript: pattern either. A plain (unencoded) dangerous style is still caught and a benign style is untouched. · *b.safeDns bounds a decompressed name across the whole compression-pointer chain* — readName tracked its per-name octet and label budgets per stack frame, so each compression-pointer jump restarted a fresh RFC 1035 255-octet / label budget and a pointer was charged as only its 2 on-wire bytes. A crafted pointer chain therefore decompressed a single name well past the advertised 255-octet / label caps (a decompression-amplification DoS on untrusted DNS responses). The octet and label accountants now thread through the whole pointer chain, so the composite decompressed name is bounded by the same caps that bound a single in-line name; independent names are still measured independently and no name that decompresses within the caps is newly rejected. · *b.auditSign refuses an anchor whose fields carry the record delimiter* — The chain-anchor signed bytes are a newline-delimited layout of format / counter / tipHash / prevTipHash / createdAt. A literal newline inside any operator-influenced string field (format / tipHash / prevTipHash) let content migrate across a field boundary without changing the signed bytes, so one signature was valid for several different { tipHash, prevTipHash } splits -- an attacker could rewrite a stored anchor's apparent tip/linkage while keeping verify() happy, defeating the prevTipHash linkage tamper-evidence. anchor() now refuses a delimiter-bearing field at sign time and verifyAnchor refuses one at verify time, so an ambiguous anchor can neither be minted nor accepted; every legitimate (delimiter-free) anchor is byte-identical and unaffected. **Detectors:** *Guard scheme extractors and CSS-danger checks must compose the shared normalizers* — Two structural checks assert that a content guard which resolves a URL scheme for a denylist routes the decoded value through b.codepointClass.stripUrlSchemeWhitespace, and that a guard's CSS-danger check matches the entity-decoded style value via b.codepointClass.decodeMarkupEntities -- so a future guard cannot silently fold away a narrower set of encodings than the browser and re-open the bypass class.

package/lib/auth/jwt.js

@@ -126,6 +126,27 @@ function _resolveAlgorithm(alg) {
   return ALGORITHM_TO_NODE[alg];
 }
 
+// Bind the declared `alg` to the key that will actually produce/verify the
+// signature. node:crypto.sign/verify with a null digest select the algorithm
+// from the KeyObject's intrinsic type — NOT from the JWS `alg` header — so the
+// header value is only an unauthenticated label unless we cross-check it here.
+// Without this, verify()'s algorithm allowlist gates on that label while the
+// crypto runs against whatever the key is: an ML-DSA-signed token can declare
+// alg="SLH-DSA-SHAKE-256f" and pass an SLH-only allowlist (CWE-347 algorithm
+// confusion / allowlist bypass), and sign() can emit a token whose header
+// misstates its own signature algorithm. `alg` MUST already be a registry key
+// (callers validate via _resolveAlgorithm or the verify allowlist gate).
+function _assertAlgMatchesKey(alg, key, kind) {
+  var expectedNodeType = ALGORITHM_TO_NODE[alg];
+  var actual = key && typeof key.asymmetricKeyType === "string" ? key.asymmetricKeyType : null;
+  if (actual !== expectedNodeType) {
+    throw new AuthError("auth-jwt/alg-key-mismatch",
+      "declared alg '" + alg + "' requires a '" + expectedNodeType + "' key but the " +
+      kind + " key is '" + (actual || "unknown") + "' — the JWS alg header must be bound to " +
+      "the key's actual algorithm (CWE-347 algorithm confusion)");
+  }
+}
+
 // ---- sign ----
 
 async function sign(claims, opts) {
@@ -136,6 +157,10 @@ async function sign(claims, opts) {
   var alg = opts.algorithm || DEFAULT_ALGORITHM;
   _resolveAlgorithm(alg);
   var key = _toKeyObject(opts.privateKey, "private");
+  // Refuse to emit a token whose header alg misstates the signing key's real
+  // algorithm — that mislabeled token is exactly what the verify-side
+  // allowlist bypass consumes. Config-time throw (operator catches the typo).
+  _assertAlgMatchesKey(alg, key, "private");
 
   var nowMs = opts.now || Date.now();
   var nowSec = Math.floor(nowMs / C.TIME.seconds(1));
@@ -306,6 +331,15 @@ async function verify(token, opts) {
       "token alg='" + decoded.header.alg + "' is not in the allowed list [" + allowed.join(", ") + "]");
   }
 
+  // The allowlist gate above only constrains the SELF-DECLARED header.alg — a
+  // label the issuer controls. node:crypto.verify(null, ...) selects the real
+  // algorithm from the KeyObject, so a token can pass an SLH-only allowlist
+  // while being verified with an ML-DSA key (or vice versa). Bind the declared
+  // alg to the resolved key's actual algorithm before verifying, so the
+  // allowlist genuinely constrains which algorithm authenticated the token
+  // (CWE-347). decoded.header.alg is a registry key here (it passed the gate).
+  _assertAlgMatchesKey(decoded.header.alg, key, "public");
+
   var verified = false;
   try {
     verified = nodeCrypto.verify(null, Buffer.from(decoded.signingInput, "ascii"), key, decoded.signature);

package/lib/auth/saml.js

@@ -704,6 +704,24 @@ function create(opts) {
         }
         var recipHok = _attr(scdHok, "Recipient");
         if (!recipHok || recipHok !== opts.assertionConsumerServiceUrl) continue;   // §3.1→§4.1.4.2 — Recipient is mandatory; absent fails the endpoint binding
+        // §3.1→§4.1.4.2 — a solicited response's SubjectConfirmationData
+        // InResponseTo MUST equal the stored AuthnRequest ID. The Bearer path
+        // below enforces this when the operator supplies expectedInResponseTo;
+        // holder-of-key is a sibling reader of the SAME SubjectConfirmationData
+        // and applies the identical replay check. Omitting it let an operator
+        // that opted into InResponseTo binding silently lose it on every HoK
+        // confirmation (possession-proof is a separate control, not a licence
+        // to skip the solicited-response correlation the operator requested).
+        var irtHok = _attr(scdHok, "InResponseTo");
+        if (vopts.expectedInResponseTo) {
+          if (irtHok === null || irtHok === undefined ||
+              !timingSafeEqual(irtHok, vopts.expectedInResponseTo)) {
+            throw new AuthError("auth-saml/bad-in-response-to",
+              "SubjectConfirmation InResponseTo does not match expected " +
+              "AuthnRequest ID (replay defense)");
+          }
+        }
+        matchedInResponseTo = irtHok;
         hokOk = true;
         break;
       }
@@ -836,7 +854,7 @@ function create(opts) {
       sessionIndex:    sessionIndex,
       attributes:      attributes,
       audience:        audience,
-      inResponseTo:    bearerOk ? matchedInResponseTo : null,
+      inResponseTo:    (bearerOk || hokOk) ? matchedInResponseTo : null,
       issuer:          issuer,
     };
   }

package/lib/guard-jwt.js

@@ -312,9 +312,25 @@ function _detectIssues(input, opts) {
     }
   }
 
-  // Payload claim sanity (only if payload is decodable).
+  // Payload claim sanity. A JWT claims set MUST be a JSON object (RFC 7519
+  // §7.2); a payload that does not decode to one — undecodable base64url,
+  // non-JSON bytes, a JSON primitive, or a JSON array — is refused
+  // symmetrically with the header-decode path above. Skipping it silently
+  // (the earlier behaviour) let the required-claims and exp/nbf/iat sanity
+  // checks never run, so a token carrying no readable claims set passed at
+  // strict with the guard's advertised required-claims enforcement bypassed.
   var payload = _b64urlDecodeJson(payloadSeg);
-  if (payload && typeof payload === "object") {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    issues.push({
+      kind: "payload-decode", severity: "high",
+      ruleId: "jwt.payload-decode",
+      snippet: "JWT payload is not a decodable JSON object (a JWT claims " +
+               "set must be a JSON object per RFC 7519 §7.2) or contains " +
+               "prototype-pollution keys",
+    });
+    return issues;
+  }
+  {
     var nowSec = Math.floor(Date.now() / 1000);                                  // seconds-per-millisecond conversion
 
     // exp in the past.

package/lib/http-message-signature.js

@@ -379,6 +379,24 @@ function sign(msg, opts) {
   }
   validateOpts.requireNonEmptyString(opts.privateKey,
     "httpSig.sign: privateKey (PEM)", HttpSigError, "BAD_OPT");
+  // Bind the declared alg to the signing key's real type. SUPPORTED_ALGS names
+  // ARE node's asymmetricKeyType values ("ed25519" / "ml-dsa-65"), so signing
+  // an ed25519 key under alg="ml-dsa-65" would emit an authenticated `alg`
+  // label that misstates the real algorithm -- a false PQC-signed claim that a
+  // verifier trusting the label would honor. Refuse the mislabeled artifact at
+  // sign time (matching every other signature verifier in the framework and the
+  // verify-side check below; alg-confusion family, CWE-347).
+  // Parse only to read the type; an unparseable key is left for the sign step
+  // below to reject (SIGN_FAILED), preserving that contract. A parseable key
+  // whose type differs from the declared alg is the mislabel we refuse here.
+  var signKeyType = null;
+  try { signKeyType = nodeCrypto.createPrivateKey(opts.privateKey).asymmetricKeyType; }
+  catch (_e) { signKeyType = null; }
+  if (signKeyType !== null && signKeyType !== opts.alg) {
+    throw _err("BAD_OPT",
+      "httpSig.sign: alg '" + opts.alg + "' does not match the private key's type '" +
+      signKeyType + "' (the alg label must be bound to the key's real algorithm)");
+  }
   if (!Array.isArray(opts.covered) || opts.covered.length === 0) {
     throw _err("BAD_OPT", "httpSig.sign: covered must be a non-empty array");
   }
@@ -614,6 +632,22 @@ function verify(msg, opts) {
   if (typeof publicKeyPem !== "string" || publicKeyPem.length === 0) {
     return { valid: false, reason: "unknown-keyid", keyid: p.keyid };
   }
+  // Bind the (authenticated) declared alg to the resolved key's real type
+  // BEFORE the crypto check. nodeCrypto.verify(null, ...) selects the algorithm
+  // from the key, not from p.alg, so a key whose type differs from p.alg means
+  // the alg label misstates the real signature algorithm (e.g. a classical
+  // ed25519 key under a declared PQC alg="ml-dsa-65"). Refuse rather than verify
+  // under a mislabeled alg (alg-confusion family, CWE-347) -- SUPPORTED_ALGS
+  // names ARE the asymmetricKeyType values.
+  // Parse only to read the type; an unparseable key is left for the crypto
+  // step below to reject (verify-threw), preserving that contract. A parseable
+  // key whose type differs from the declared alg is the mislabel we refuse here.
+  var verifyKeyType = null;
+  try { verifyKeyType = nodeCrypto.createPublicKey(publicKeyPem).asymmetricKeyType; }
+  catch (_e) { verifyKeyType = null; }
+  if (verifyKeyType !== null && verifyKeyType !== p.alg) {
+    return { valid: false, reason: "alg-key-mismatch", alg: p.alg, keyType: verifyKeyType };
+  }
 
   // If content-digest is covered, recompute and compare. RFC 9421 §B.2.5
   // mandates that verifiers re-run the digest over the body — a stale

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.20",
+  "version": "0.16.21",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4eff6a21-428a-4198-9028-b4137d2c90c5",
+  "serialNumber": "urn:uuid:96b6222d-f898-4aa7-beb8-1b0c830965bd",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T13:00:38.123Z",
+    "timestamp": "2026-07-12T14:22:26.336Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.20",
+      "bom-ref": "@blamejs/core@0.16.21",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.20",
+      "version": "0.16.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.20",
+      "purl": "pkg:npm/%40blamejs/core@0.16.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.20",
+      "ref": "@blamejs/core@0.16.21",
       "dependsOn": []
     }
   ]