@blamejs/core 0.16.28 → 0.16.30

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.30 (2026-07-13) — **Reject a malformed IPv6 address whose '::' compresses no groups (and a leading-zero embedded-IPv4 tail) in the shared IP validator and the CIDR guard, and complete third-party license attribution for the vendored elliptic-curve library and the Public Suffix List.** The shared IPv6 text parser accepted an address where a '::' sat next to a full eight explicit groups (for example 1:2:3:4:5:6:7:8::, ::1:2:3:4:5:6:7:8, or 1:2:3:4:5:6:7::8). RFC 4291 §2.2 defines '::' as an abbreviation for one or more all-zero groups, so those forms compress nothing and are not valid IPv6 text -- Node's built-in net.isIP rejects every one of them. The parser computed the number of groups to insert but only rejected a negative count, so a zero-insert '::' passed. Because each accepted spelling still normalizes to the same address as its canonical form, no allow/deny decision was bypassed, but the validator disagreed with net.isIP and with any strict peer parser on a whole class of inputs. b.mail (SPF/DMARC/RBL/greylist/HELO) and b.guardCidr both parse IPv6 through the affected code, so both now reject these forms. The embedded IPv4 tail of an IPv4-mapped address is also now validated with the framework's strict dotted-quad check, so a leading-zero, octal-ambiguous octet such as ::ffff:01.2.3.4 is refused rather than silently reinterpreted. Separately, the third-party NOTICE file was missing two vendored components that ship in the package -- the @noble/curves elliptic-curve library (MIT, used by the OPRF primitive) and the Mozilla Public Suffix List (MPL-2.0) -- both are now attributed, and a repository supply-chain policy records why the framework's inherent network, configuration, vendored-bundle, and data-file characteristics are expected. **Changed:** *Complete third-party license attribution for the vendored @noble/curves library and the Public Suffix List, and refresh the vendored Public Suffix List* — The NOTICE file, which attributes every third-party component vendored under lib/vendor/, was missing two that ship in the package: the @noble/curves elliptic-curve library (MIT, used by the OPRF primitive) and the Mozilla Public Suffix List (MPL-2.0, used for organizational-domain derivation in DMARC alignment, BIMI scoping, and cookie-scope confinement). Both are now attributed; the Public Suffix List entry records that it is vendored verbatim under MPL-2.0 with its canonical source URL, satisfying MPL-2.0 §3.2. A stale vendored-library version in the same file was also corrected. The vendored Public Suffix List itself was refreshed to the current upstream snapshot so organizational-domain derivation reflects the latest registry delegations. A repository supply-chain policy also documents why the framework's inherent network egress, configuration reads, vendored minified bundles, and permissively- or open-data-licensed data files are expected characteristics rather than findings. **Security:** *b.mail and b.guardCidr reject a malformed IPv6 address whose '::' compresses zero groups, matching RFC 4291 and net.isIP* — The shared IPv6 text parser inserted 8 - (left groups) - (right groups) zero groups for a '::' and rejected only a negative result, so an address with a full eight explicit groups adjacent to a '::' -- 1:2:3:4:5:6:7:8::, ::1:2:3:4:5:6:7:8, 1:2:3:4:5:6:7::8, 1:2:3:4::5:6:7:8 -- was accepted even though RFC 4291 §2.2 requires '::' to stand for at least one all-zero group and net.isIP rejects all of them. The parser now requires a '::' to insert at least one group. Every affected spelling normalized to the same address as its canonical form, so no CIDR or SPF/DMARC allow/deny decision was bypassed; the fix removes a parser divergence from the platform and peer parsers on a whole class of inputs. The same zero-group check was applied to the separate IPv6 parser inside b.guardCidr, and the embedded IPv4 tail of an IPv4-mapped IPv6 address is now validated with the framework's strict dotted-quad check so a leading-zero / octal-ambiguous octet (for example ::ffff:01.2.3.4) is refused instead of reinterpreted. Legitimate compressed and IPv4-mapped addresses are unchanged.
+
+- v0.16.29 (2026-07-13) — **Reject a backup manifest's absolute, drive-letter, or NTFS-stream path at validation and resolve every path through the framework path-safety primitive on both backup and restore, and stop a bound-key auth middleware from hanging when a required peer certificate is absent.** Two defects surfaced while covering the backup/restore path handling and the bound-key auth middleware. A backup manifest's file paths were checked only for a leading separator and .., so a Windows drive-letter path such as C:\Windows\evil, or a colon-bearing NTFS alternate-data-stream marker such as db.enc:evil, passed b.backupManifest.validate, and the backup and restore steps joined the caller- or manifest-declared relativePath and encryptedPath directly, without the framework's path-safety primitive -- so a path built from untrusted input could read a file outside dataDir on backup, or aim a restored file (or a blob read) outside the staging directory on restore. validate now rejects a colon anywhere (both the drive-letter prefix and the alternate-data-stream marker) alongside .. and a leading separator, and both b.backupBundle.create and b.restoreBundle resolve every manifest-declared path through b.safePath (which refuses traversal, absolute, drive-letter, UNC, NTFS alternate-data-stream, and reserved-name paths), so each sink is contained even if a path slips past the first-line check. Separately, b.middleware.requireBoundKey dereferenced req.peerCert.raw in its peer-certificate pinning branch when a fingerprint had been pre-attached by upstream mTLS but the certificate object was absent, throwing an uncaught TypeError that rejected the middleware promise -- the request hung with no response instead of a clean fail-closed denial; the branch now guards the certificate and denies. **Fixed:** *b.middleware.requireBoundKey fails closed instead of hanging when a required peer certificate is absent* — In the peer-certificate pinning branch, the middleware read req.peerCert.raw without checking that req.peerCert was present. When an upstream mTLS layer had pre-attached a peer fingerprint (req.peerFingerprint) but no certificate object, that read threw an uncaught TypeError, which rejected the middleware's promise -- the request received no response and hung, rather than a clean fail-closed 401/403. The branch now checks for the certificate before dereferencing it and denies when it is missing, so a peer-cert-pinned key without a usable certificate is refused, not stalled. **Security:** *Backup and restore resolve every filesystem path through b.safePath, and b.backupManifest.validate rejects an absolute, drive-letter, or NTFS-stream path* — A backup manifest's per-file relativePath and encryptedPath were validated only against .. and a leading / or \, so a Windows drive-absolute path (C:\...) or an NTFS alternate-data-stream marker (db.enc:evil) passed b.backupManifest.validate, and the backup, restore, and storage-adapter steps built their filesystem paths with a plain path join of the caller- or manifest-supplied values -- meaning a path built from untrusted input could read a file outside dataDir on backup, aim a decrypted-file write or an encrypted-blob read outside the intended directory on restore, or escape the storage root through the filesystem adapter. validate() now rejects a colon anywhere (covering both the drive-letter prefix and the alternate-data-stream marker) alongside .. and a leading separator, and every filesystem sink -- b.backupBundle.create (the source read), b.restoreBundle (the encrypted-blob read and the restore destination), and the b.backup.bundleAdapterStorage.fsAdapter key resolver -- resolves its path through b.safePath, which refuses traversal, absolute, drive-letter, UNC, NTFS alternate-data-stream, and Windows reserved-name components and contains the result under its base. (The object-store storage adapter builds an object key, not a filesystem path, and keeps its traversal/NUL check -- a colon is a legal object-key character.) Legitimate relative paths back up and restore unchanged.
+
 - v0.16.28 (2026-07-13) — **Fix a Sieve filter bypass where an explicit :comparator silently disabled a header/address/envelope test, plus a JSONPath normalized-path round-trip fault and a rejected daemon cwd option.** Three defects surfaced while covering the Sieve interpreter, JSONPath engine, and daemon supervisor. In b.mail.sieve, an explicit :comparator on a header, address, or envelope test silently disabled the whole test: the Sieve parser did not bind the comparator name to its tag, so the comparator string was consumed as the first positional argument (the header/address name) and every real argument shifted by one -- the test looked up a non-existent header, never matched, and the message fell through to implicit keep, so a discard / fileinto / redirect that should have fired instead delivered the message. The parser now binds :comparator to its tag (RFC 5228 §2.7.3), so the comparator is applied and the arguments stay aligned. b.jsonPath.paths emitted a normalized path containing raw control characters (only ' and \ were escaped), which the query parser then rejected, so a path returned by paths() did not round-trip through query(); control characters are now escaped per RFC 9535 §2.7. And b.daemon.start rejected its own documented cwd option with an unknown-option error; cwd is now accepted and forwarded as the detached child's working directory. **Fixed:** *b.jsonPath.paths emits a normalized path that round-trips through b.jsonPath.query* — A normalized path returned by paths() escaped only the single-quote and backslash characters inside a member name, leaving raw control characters (newline, tab, and the rest of U+0000 through U+001F) in the output. The query parser rejects an unescaped control character in a name selector, so such a path could not be fed back into query(). Control characters in a normalized-path name are now escaped as their short form (\b \t \n \f \r) or \uXXXX, per RFC 9535 §2.7, so paths() output round-trips. · *b.daemon.start accepts and applies the documented cwd option* — The start() options validator did not list cwd among the accepted options, so passing the documented cwd (the working directory for the detached child) was rejected with a daemon/bad-opts unknown-option error and the feature was unusable. cwd is now an accepted optional string and is forwarded to the detached child spawn as its working directory. **Security:** *b.mail.sieve applies an explicit :comparator instead of silently disabling the test* — A Sieve script that used an explicit :comparator on a header, address, or envelope test -- for example header :comparator "i;octet" :is "Subject" "..." -- silently stopped filtering. The parser did not attach the comparator's value string to the :comparator tag, so it was consumed as the first positional argument (the header or address name) and shifted the real name and key list by one position. The test then queried a non-existent header, never matched, and evaluation fell through to implicit keep, so a discard, fileinto, or reject the operator intended was not applied and the message was delivered anyway -- a filter bypass for any rule with an explicit comparator. The parser now binds :comparator to its tag per RFC 5228 §2.7.3, so the chosen comparator (i;octet exact vs the default i;ascii-casemap case-insensitive) is applied and the positional arguments stay aligned; a :comparator with no following comparator-name string is refused at parse time.
 
 - v0.16.27 (2026-07-12) — **Fix b.pubsub pattern subscriptions silently dropping every message for a single-wildcard pattern such as orders.*.created.** b.pubsub.subscribePattern with a * wildcard between dotted segments never matched any channel, so a pattern subscriber received nothing. The documented flagship pattern orders.*.created silently dropped orders.eu.created, and the same held for a.*.c, a.*.b.*.c, and any pattern whose wildcard sits between literal segments -- the source @example itself did not work. The segment matcher required a literal that follows a * to fit entirely before the next dot, but a trailing literal like .created contains a dot and legitimately begins before that boundary, so the match was rejected. The matcher now lets a post-wildcard literal begin at or before the next dot and matches it verbatim, while a single-segment * still never spans a dot -- so orders.*.created matches orders.eu.created but not orders.eu.fr.created or orders.created, and a pattern subscriber never receives a message from an extra path segment. Surfaced while covering the pub/sub matcher's branches. **Fixed:** *b.pubsub.subscribePattern matches a single-segment wildcard between literal segments* — A pattern with a * between dotted segments (the documented orders.*.created, or any a.*.c / a.*.b.*.c) matched no channel at all, so the pattern subscriber's handler never fired. The matcher rejected the literal that follows a wildcard unless it fit entirely before the next dot, but a trailing literal such as .created contains a dot and starts before that boundary, so a legitimate match was dropped. The literal after a wildcard is now allowed to begin at or before the next dot and is matched verbatim; the wildcard still matches exactly one non-dot segment, so orders.*.created matches orders.eu.created but not orders.eu.fr.created (two segments) or orders.created (none) -- a pattern subscription never widens to an extra path segment. Behaviour is now consistent with the documented example.

package/NOTICE

@@ -25,6 +25,16 @@ Used for:    XChaCha20-Poly1305 authenticated encryption (lib/crypto.js,
              lib/vault-wrap.js, via lib/vendor/noble-ciphers.cjs).
              Thank you to Paul Miller for the audited noble-ciphers suite.
 --------------------------------------------------------------------------------
+Component:   @noble/curves
+Version:     2.2.0
+Source:      https://github.com/paulmillr/noble-curves
+License:     MIT
+Copyright:   Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+Used for:    RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF)
+             over ristretto255 / P-256 / P-384 / P-521 (lib/crypto-oprf.js,
+             via lib/vendor/noble-curves.cjs). Thank you to Paul Miller for the
+             audited noble-curves suite.
+--------------------------------------------------------------------------------
 Component:   @noble/post-quantum
 Version:     0.6.1
 Source:      https://github.com/paulmillr/noble-post-quantum
@@ -41,7 +51,7 @@ Used for:    FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024),
              reference implementation.
 --------------------------------------------------------------------------------
 Component:   @simplewebauthn/server
-Version:     13.3.0
+Version:     13.3.2
 Source:      https://github.com/MasterKale/SimpleWebAuthn
 License:     MIT
 Copyright:   Copyright (c) Matthew Miller
@@ -79,3 +89,18 @@ Used for:    Top-10000 most-common (breach-derived) passwords. Loaded by
              project maintainers for keeping a curated, freely-redistributable
              baseline.
 --------------------------------------------------------------------------------
+Component:   publicsuffix-list (Mozilla Public Suffix List)
+Version:     master snapshot (bundled 2026-07-13)
+Source:      https://publicsuffix.org/list/public_suffix_list.dat
+License:     MPL-2.0
+Copyright:   Copyright (c) Mozilla Foundation and Public Suffix List contributors
+Used for:    Canonical catalog of effective top-level domains. Loaded at module
+             init by b.publicSuffix to derive organizational domains for
+             DMARCbis (psd= / np=) alignment, BIMI issuer scoping, cookie-scope
+             confinement, and same-site policy (lib/public-suffix.js, via
+             lib/vendor/public-suffix-list.dat). This is data, not a code
+             bundle. The list is vendored verbatim and unmodified and remains
+             licensed under the Mozilla Public License 2.0; its complete source
+             is available at the canonical URL above, satisfying MPL-2.0 §3.2.
+             The full MPL-2.0 text is at https://www.mozilla.org/MPL/2.0/.
+--------------------------------------------------------------------------------

package/lib/backup/bundle.js

@@ -51,6 +51,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var bCrypto = require("./crypto");
 var backupManifest = require("./manifest");
 var validateOpts = require("../validate-opts");
@@ -122,11 +123,20 @@ async function create(opts) {
       throw new BackupBundleError("backup-bundle/bad-include",
         "create: files[" + i + "] requires { relativePath: string }");
     }
-    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath)) {
+    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath) ||
+        entry.relativePath.indexOf(":") !== -1) {
+      // A colon anywhere is refused alongside '..' and a leading separator: it
+      // covers both a Windows drive prefix (C:\..., absolute) and an NTFS
+      // alternate-data-stream marker (db.enc:evil). This friendly pre-screen
+      // mirrors b.backupManifest.validate; safePath.resolve below is the
+      // authoritative sink for the residual classes (UNC, reserved name, etc.).
       throw new BackupBundleError("backup-bundle/bad-include",
-        "create: files[" + i + "].relativePath must be a relative path (got '" + entry.relativePath + "')");
+        "create: files[" + i + "].relativePath must be a relative path without '..', a leading separator, or a colon (got '" + entry.relativePath + "')");
     }
-    var srcPath = nodePath.join(dataDir, entry.relativePath);
+    // Resolve the source path THROUGH dataDir with safePath so a relativePath
+    // built from untrusted input can't read a file outside dataDir even if it
+    // slips the first-line check (UNC, reserved name, encoded separator, bidi).
+    var srcPath = safePath.resolve(dataDir, entry.relativePath);
     if (!nodeFs.existsSync(srcPath)) {
       if (entry.required) {
         throw new BackupBundleError("backup-bundle/missing-required",

package/lib/backup/index.js

@@ -55,6 +55,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var bCrypto = require("../crypto");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var C = require("../constants");
 var backupBundle = require("./bundle");
 var frameworkFiles = require("../framework-files");
@@ -2197,13 +2198,23 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
   atomicFile.ensureDir(root);
 
   function _keyPath(key) {
-    // Refuse keys with traversal segments — defense in depth even
-    // though the storage layer also checks.
-    if (key.indexOf("..") !== -1 || key.indexOf("\0") !== -1) {
+    // Gate the key under Windows path semantics REGARDLESS of the host, then
+    // resolve the real on-disk path with the host's semantics. An fsAdapter
+    // store is portable — a bundle written on one OS is often read on another —
+    // and win32 splits on both `/` and `\`, so a key like `..\evil` (a harmless
+    // literal filename under POSIX, but a climb out of root when the same key is
+    // later interpreted on Windows) is refused everywhere. The gate is a strict
+    // superset of the host's, also refusing an absolute / drive-letter / UNC
+    // prefix, an NTFS alternate-data-stream marker, a Windows reserved name, and
+    // NUL / control bytes; defense in depth even though the storage layer also
+    // checks. A hand-rolled '..' + NUL substring check (the prior shape) missed
+    // the drive / ADS / reserved-name class the shared primitive handles, and a
+    // host-only resolve missed the cross-platform backslash-traversal class.
+    if (safePath.resolveOrNull(root, key, { platform: "win32" }) === null) {
       throw new BackupError("backup/bad-key",
-        "fsAdapter: key contains invalid characters: " + JSON.stringify(key));
+        "fsAdapter: key contains invalid or unsafe path characters: " + JSON.stringify(key));
     }
-    return nodePath.join(root, key);
+    return safePath.resolve(root, key);
   }
 
   return {

package/lib/backup/manifest.js

@@ -121,14 +121,19 @@ function _validateFileEntry(f, idx, errors) {
   }
   if (typeof f.relativePath !== "string" || f.relativePath.length === 0) {
     errors.push("files[" + idx + "].relativePath: required non-empty string");
-  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath)) {
-    // No traversal — when restored, relativePath joins under dataDir
-    errors.push("files[" + idx + "].relativePath: must be a relative path without '..' or leading separator");
+  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath) || f.relativePath.indexOf(":") !== -1) {
+    // No traversal — when restored, relativePath joins under dataDir. A colon
+    // anywhere is refused alongside '..' and a leading separator: it covers
+    // both a Windows drive prefix (C:\..., absolute — path.resolve would honor
+    // it and escape dataDir) and an NTFS alternate-data-stream marker
+    // (db.enc:evil), so validate() fails closed before restore, matching the
+    // safePath sink b.restoreBundle resolves both paths through.
+    errors.push("files[" + idx + "].relativePath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.encryptedPath !== "string" || f.encryptedPath.length === 0) {
     errors.push("files[" + idx + "].encryptedPath: required non-empty string");
-  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath)) {
-    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..' or leading separator");
+  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath) || f.encryptedPath.indexOf(":") !== -1) {
+    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.size !== "number" || !Number.isInteger(f.size) || f.size < 0) {
     errors.push("files[" + idx + "].size: required non-negative integer");

package/lib/guard-cidr.js

@@ -182,6 +182,11 @@ function _parseIpv6(s) {
     if (left === null || right === null) return null;
     var pad = IPV6_GROUPS - left.length - right.length;
     if (pad < 0) return null;
+    // RFC 4291 §2.2 — "::" must compress at least one all-zero group. Eight
+    // explicit groups adjacent to a "::" (pad === 0) compress nothing and are
+    // malformed IPv6 text (net.isIP rejects them), so reject rather than accept
+    // a non-canonical spelling into CIDR matching.
+    if (pad === 0) return null;
     var zeros = [];
     for (var z = 0; z < pad; z += 1) zeros.push("0000");                         // IPv6 zero group
     groups = left.concat(zeros).concat(right);

package/lib/ip-utils.js

@@ -30,8 +30,12 @@ function expandIpv6Hex(ip) {
   // RFC 4291 §2.5.5.2 IPv4-mapped / dual-stack: accept ".d.d.d.d" tail.
   var dual = ip.match(/^(.*?):(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);                                    // allow:regex-no-length-cap — dotted-quad has fixed shape; LHS bounded by IPv6 group cap below
   if (dual) {
+    // The embedded IPv4 tail must be a strict RFC 791 dotted-quad. Reuse the
+    // canonical isIPv4 (rejects octets > 255 AND leading-zero / octal-ambiguous
+    // octets like "01") so this mapped-form parse doesn't diverge from net.isIP
+    // or from the standalone isIPv4 validator on the same dotted-quad.
+    if (!isIPv4(dual[2])) return null;
     var v4 = dual[2].split(".").map(Number);
-    if (v4.some(function (o) { return !(o >= 0 && o <= 255); })) return null;                            // IPv4 octet range
     var hi = (v4[0] << 8) | v4[1];                                                                       // 16-bit group pack
     var lo = (v4[2] << 8) | v4[3];                                                                       // 16-bit group pack
     ip = dual[1] + ":" + hi.toString(16) + ":" + lo.toString(16);
@@ -43,6 +47,12 @@ function expandIpv6Hex(ip) {
   if (dblColon.length === 1 && leftGroups.length !== 8) return null;                                      // RFC 4291 IPv6 group count
   var fillCount = 8 - leftGroups.length - rightGroups.length;                                             // RFC 4291 IPv6 group count
   if (fillCount < 0) return null;
+  // RFC 4291 §2.2 — "::" abbreviates ONE OR MORE groups of all-zero 16-bit
+  // fields, so when a "::" is present it must insert at least one group. Eight
+  // explicit groups plus a "::" (e.g. 1:2:3:4:5:6:7:8:: or 1:2:3:4:5:6:7::8)
+  // compresses zero groups and is not valid IPv6 text; net.isIP rejects these,
+  // so reject them here too rather than diverge from the kernel/peer parser.
+  if (dblColon.length === 2 && fillCount === 0) return null;
   var fill = [];
   for (var f = 0; f < fillCount; f += 1) fill.push("0");
   var groups = leftGroups.concat(fill).concat(rightGroups);

package/lib/middleware/require-bound-key.js

@@ -289,7 +289,7 @@ function create(opts) {
             keyId: record.id || null,
           });
         }
-      } else if (!bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
+      } else if (!(req.peerCert && req.peerCert.raw) || !bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
         // isCertRevoked returns true on MATCH against the deny-list
         // shape; we use it here as a fingerprint-set membership test
         // because it does the same constant-time hex/colon comparison

package/lib/restore-bundle.js

@@ -50,6 +50,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
+var safePath = require("./safe-path");
 var C = require("./constants");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
@@ -226,7 +227,11 @@ async function extract(opts) {
         continue;
       }
 
-      var blobPath = nodePath.join(bundleDir, entry.encryptedPath);
+      // Resolve the manifest-declared encrypted-blob path THROUGH the base with
+      // safePath -- a tampered manifest could otherwise carry a traversal /
+      // absolute / drive-letter / NTFS-ADS encryptedPath and read a file outside
+      // the bundle. manifest.validate is a first-line check; this is the sink.
+      var blobPath = safePath.resolve(bundleDir, entry.encryptedPath);
       // Cap the read to the manifest's declared encryptedSize so an oversize-on-
       // disk blob is refused BEFORE it is read into memory (was: read fully, then
       // compare → an OOM window for a huge swapped blob). A valid blob is exactly
@@ -282,7 +287,10 @@ async function extract(opts) {
           " — bundle is corrupted or manifest tampered");
       }
 
-      var destPath = nodePath.join(stagingDir, entry.relativePath);
+      // Resolve the restore destination THROUGH the staging base with safePath
+      // so a tampered relativePath (traversal / absolute / drive-letter / ADS)
+      // cannot escape stagingDir when the decrypted file is written.
+      var destPath = safePath.resolve(stagingDir, entry.relativePath);
       atomicFile.ensureDir(nodePath.dirname(destPath));
       atomicFile.writeSync(destPath, plaintext, { fileMode: 0o600 });
 

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c"
       },
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-06-24T00:00:00Z",
+      "bundledAt": "2026-07-13T00:00:00Z",
       "hashes": {
-        "server": "sha256:b86d21bda9c627f0fdbb0182a16a441992e53dc74eb3e866e7885660df863dbd",
-        "data_js": "sha256:72fb435e03a25bece67f744601e75e3fb7972f264336ddf7cfcb13ddccedb73e"
+        "server": "sha256:b6270a246d7bffbe85ad1fb2908abad74828ac5b95bad81cd0cde236955ce444",
+        "data_js": "sha256:13b7fa0a62d7b86e5a46468d5d252addd4e54f20143ef3377a5f042b36abf22e"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-07-10T14:22:17.414Z"
+      "refreshedAt": "2026-07-13T22:58:54.983Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-09_11-59-23_UTC
-// COMMIT: b9a86cf0cd115f1e60b5815533f3fcfd2f9e8f4b
+// VERSION: 2026-07-13_21-14-34_UTC
+// COMMIT: 8eb9e60139cb2c62ccec664554adae3767dc1374
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -1176,12 +1176,16 @@ gov.gd
 // Confirmed by registry <info@nic.ge> 2024-11-20
 ge
 com.ge
+cyb.ge
 edu.ge
 gov.ge
+llc.ge
 net.ge
+online.ge
 org.ge
 pvt.ge
 school.ge
+tnx.ge
 
 // gf : https://www.iana.org/domains/root/db/gf.html
 gf
@@ -1464,11 +1468,14 @@ tv.im
 // Please note, that nic.in is not an official eTLD, but used by most
 // government institutions.
 // Confirmed by Gaurav Kansal <gaurav.kansal@nic.in> 2025-11-06
+// Added aero.in, alumni.in, school.in and ub.in by Gaurav Kansal <gaurav.kansal@nic.in> 2026-06-25
 in
 5g.in
 6g.in
 ac.in
+aero.in
 ai.in
+alumni.in
 am.in
 bank.in
 bihar.in
@@ -1503,8 +1510,10 @@ pg.in
 post.in
 pro.in
 res.in
+school.in
 travel.in
 tv.in
+ub.in
 uk.in
 up.in
 us.in
@@ -4336,14 +4345,18 @@ no
 fhs.no
 folkebibl.no
 fylkesbibl.no
+gielda.no
+herad.no
 idrett.no
+kommune.no
 museum.no
 priv.no
+suohkan.no
+tjielte.no
+uenorge.no
 vgs.no
 // Norid category second-level domains managed by parties other than Norid : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-d/
 dep.no
-herad.no
-kommune.no
 mil.no
 stat.no
 // Norid geographical second level domains : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-b/
@@ -4484,7 +4497,7 @@ askøy.no
 askvoll.no
 asnes.no
 åsnes.no
-audnedaln.no
+audnedal.no
 aukra.no
 aure.no
 aurland.no
@@ -4595,7 +4608,6 @@ forsand.no
 fosnes.no
 fræna.no
 frana.no
-frei.no
 frogn.no
 froland.no
 frosta.no
@@ -4646,6 +4658,7 @@ halden.no
 halsa.no
 hamar.no
 hamaroy.no
+hamarøy.no
 hammarfeasta.no
 hámmárfeasta.no
 hammerfest.no
@@ -4700,6 +4713,7 @@ karasjohka.no
 kárášjohka.no
 karasjok.no
 karlsoy.no
+karlsøy.no
 karmoy.no
 karmøy.no
 kautokeino.no
@@ -4888,6 +4902,7 @@ ralingen.no
 rana.no
 randaberg.no
 rauma.no
+re.no
 rendalen.no
 rennebu.no
 rennesoy.no
@@ -5045,6 +5060,7 @@ tysvær.no
 tysvar.no
 ullensaker.no
 ullensvang.no
+ulstein.no
 ulvik.no
 unjarga.no
 unjárga.no
@@ -14231,6 +14247,12 @@ iopsys.se
 // Submitted by Matthew Hardeman <mhardeman@ipifony.com>
 ipifony.net
 
+// IPv64.net : https://ipv64.net/
+// Submitted by Dennis Schröder <info@ipv64.net>
+home64.de
+ipv64.de
+ipv64.net
+
 // ir.md : https://nic.ir.md
 // Submitted by Ali Soizi <info@nic.ir.md>
 ir.md
@@ -15636,9 +15658,10 @@ dedibox.fr
 schokokeks.net
 
 // Scottish Government : https://www.gov.scot
-// Submitted by Martin Ellis <martin.ellis@gov.scot>
+// Submitted by Martin Ellis <digital-publishing@gov.scot>
 gov.scot
 service.gov.scot
+mygov.scot
 
 // Scry Security : http://www.scrysec.com
 // Submitted by Shante Adam <shante@skyhat.io>