@blamejs/core 0.17.11 → 0.17.13

package/lib/ssrf-guard.js

@@ -820,6 +820,56 @@ function isPrivate(ip)       { return classify(ip) === "private"; }
  */
 function isLoopback(ip)      { return classify(ip) === "loopback"; }
 
+/**
+ * @primitive b.ssrfGuard.isLoopbackHost
+ * @signature b.ssrfGuard.isLoopbackHost(host)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.ssrfGuard.isExactLoopbackName, b.ssrfGuard.isLoopback, b.ssrfGuard.canonicalizeHost
+ *
+ * Hostname-aware loopback test. Unlike `isLoopback` (IP literals only) this
+ * canonicalizes `host` (strips `[]` brackets + trailing dots, folds an
+ * IPv4-mapped IPv6, lowercases) and returns `true` for a loopback IP literal
+ * OR the RFC 6761 §6.3 reserved names `localhost` and any `*.localhost`. Pure
+ * name-shape — never resolves DNS.
+ *
+ * @example
+ *   b.ssrfGuard.isLoopbackHost("localhost");     // → true
+ *   b.ssrfGuard.isLoopbackHost("[::1]");          // → true
+ *   b.ssrfGuard.isLoopbackHost("app.localhost");  // → true
+ *   b.ssrfGuard.isLoopbackHost("example.com");    // → false
+ */
+function isLoopbackHost(host) {
+  if (typeof host !== "string" || host.length === 0) return false;
+  var canon = canonicalizeHost(host);
+  if (net.isIP(canon)) return classify(canon) === "loopback";
+  return canon === "localhost" || /\.localhost$/.test(canon);
+}
+
+/**
+ * @primitive b.ssrfGuard.isExactLoopbackName
+ * @signature b.ssrfGuard.isExactLoopbackName(host)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.ssrfGuard.isLoopbackHost
+ *
+ * Like `isLoopbackHost` but WITHOUT the `*.localhost` subdomain reservation —
+ * accepts only the exact `localhost` name or a loopback IP literal. For the
+ * OAuth/OIDC cleartext-redirect loopback exception (RFC 9700 §4.1.1), which
+ * must not widen to a `*.localhost` name an attacker could register in a resolver.
+ *
+ * @example
+ *   b.ssrfGuard.isExactLoopbackName("localhost");     // → true
+ *   b.ssrfGuard.isExactLoopbackName("127.0.0.1");     // → true
+ *   b.ssrfGuard.isExactLoopbackName("app.localhost"); // → false
+ */
+function isExactLoopbackName(host) {
+  if (typeof host !== "string" || host.length === 0) return false;
+  var canon = canonicalizeHost(host);
+  if (net.isIP(canon)) return classify(canon) === "loopback";
+  return canon === "localhost";
+}
+
 /**
  * @primitive b.ssrfGuard.isLinkLocal
  * @signature b.ssrfGuard.isLinkLocal(ip)
@@ -958,6 +1008,8 @@ module.exports = {
   createAllowlist:  createAllowlist,
   isPrivate:        isPrivate,
   isLoopback:       isLoopback,
+  isLoopbackHost:   isLoopbackHost,
+  isExactLoopbackName: isExactLoopbackName,
   isLinkLocal:      isLinkLocal,
   isCloudMetadata:  isCloudMetadata,
   isReserved:       isReserved,

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-07-15T00:00:00Z",
+      "bundledAt": "2026-07-23T00:00:00Z",
       "hashes": {
-        "server": "sha256:57323947e6a49f93c98cf417bc8dabbc99833d548add7b4fb1528382d2469c2b",
-        "data_js": "sha256:e3ab29993abf04b4a89c2ad55fa7057c234076fb078a32daecf05d3f8ed379eb"
+        "server": "sha256:da358965c19dfbc44ad7fc4ba769203a61e13be67314645e502300c2e52cac21",
+        "data_js": "sha256:ce0071657db1097831ccafeb5a282214d2a06dcbab3ae4f4053c60b987223d5b"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:2307ef65e070757ffb13442b377e45efb9fa1a10432d9b39618387720ab990ed"
       },
-      "refreshedAt": "2026-07-16T01:51:24.609Z"
+      "refreshedAt": "2026-07-23T17:16:44.262Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-15_18-13-59_UTC
-// COMMIT: 9b5c814414374aa19a93dc6dd7e47c01909524cc
+// VERSION: 2026-07-23_05-57-33_UTC
+// COMMIT: 438c5e02a9db7870300cb3108258aeefc8467c36
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -1631,7 +1631,6 @@ trentin-sudtirol.it
 trentin-südtirol.it
 trentin-sued-tirol.it
 trentin-suedtirol.it
-trentino.it
 trentino-a-adige.it
 trentino-aadige.it
 trentino-alto-adige.it
@@ -1652,7 +1651,6 @@ trentinos-tirol.it
 trentinostirol.it
 trentinosud-tirol.it
 trentinosüd-tirol.it
-trentinosudtirol.it
 trentinosüdtirol.it
 trentinosued-tirol.it
 trentinosuedtirol.it
@@ -1668,7 +1666,6 @@ umbria.it
 val-d-aosta.it
 val-daosta.it
 vald-aosta.it
-valdaosta.it
 valle-aosta.it
 valle-d-aosta.it
 valle-daosta.it
@@ -1705,7 +1702,6 @@ aosta.it
 aoste.it
 ap.it
 aq.it
-aquila.it
 ar.it
 arezzo.it
 ascoli-piceno.it
@@ -1929,6 +1925,9 @@ sondrio.it
 sp.it
 sr.it
 ss.it
+su.it
+sud-sardegna.it
+sudsardegna.it
 südtirol.it
 suedtirol.it
 sv.it
@@ -1949,6 +1948,7 @@ trani-barletta-andria.it
 traniandriabarletta.it
 tranibarlettaandria.it
 trapani.it
+trentino.it
 trento.it
 treviso.it
 trieste.it
@@ -1967,6 +1967,7 @@ ve.it
 venezia.it
 venice.it
 verbania.it
+verbano-cusio-ossola.it
 vercelli.it
 verona.it
 vi.it
@@ -12576,12 +12577,6 @@ bubbleapps.io
 // Submitted by Klara Mall <dns@bwcloud-os.de>
 *.bwcloud-os-instance.de
 
-// Bytemark Hosting : https://www.bytemark.co.uk
-// Submitted by Paul Cammish <paul.cammish@bytemark.co.uk>
-uk0.bigv.io
-dh.bytemark.co.uk
-vm.bytemark.co.uk
-
 // Caf.js Labs LLC : https://www.cafjs.com
 // Submitted by Antonio Lain <antlai@cafjs.com>
 cafjs.com
@@ -12841,10 +12836,6 @@ craft.me
 // Submitted by Ales Krajnik <ales.krajnik@craynic.com>
 realm.cz
 
-// Cryptonomic : https://cryptonomic.net/
-// Submitted by Andrew Cady <public-suffix-list@cryptonomic.net>
-*.cryptonomic.net
-
 // cyber_Folks S.A. : https://cyberfolks.pl
 // Submitted by Bartlomiej Kida <security@cyberfolks.pl>
 cfolks.pl
@@ -12927,11 +12918,6 @@ deployagent.space
 // Submitted by Peter Thomassen <peter@desec.io>
 dedyn.io
 
-// Deta : https://www.deta.sh/
-// Submitted by Aavash Shrestha <aavash@deta.sh>
-deta.app
-deta.dev
-
 // Deuxfleurs : https://deuxfleurs.fr
 // Submitted by Aeddis Desauw <ca@deuxfleurs.fr>
 deuxfleurs.eu
@@ -13511,10 +13497,6 @@ on.expo.app
 staging.expo.app
 on.staging.expo.app
 
-// Fabrica Technologies, Inc. : https://www.fabrica.dev/
-// Submitted by Eric Jiang <eric@fabrica.dev>
-onfabrica.com
-
 // fachschaften.org: https://fachschaften.org/
 // Submitted by Felix Schäfer <security@fachschaften.org>
 fspages.org
@@ -15267,10 +15249,6 @@ vki.kr
 // Submitted by yumenewa <admin@project-study.com>
 dev.project-study.com
 
-// Protonet GmbH : http://protonet.io
-// Submitted by Martin Meier <admin@protonet.io>
-protonet.io
-
 // PSL Sandbox : https://github.com/groundcat/PSL-Sandbox
 // Submitted by groundcat <psl-sandbox@alumni.upenn.edu>
 platter-app.dev
@@ -15452,10 +15430,6 @@ repl.run
 resindevice.io
 devices.resinstaging.io
 
-// RethinkDB : https://www.rethinkdb.com/
-// Submitted by Chris Kastorff <info@rethinkdb.com>
-hzc.io
-
 // Rico Developments Limited : https://adimo.co
 // Submitted by Colin Brown <hello@adimo.co>
 adimo.co.uk
@@ -15878,10 +15852,6 @@ indevs.in
 musician.io
 novecore.site
 
-// Standard Library : https://stdlib.com
-// Submitted by Jacob Lee <jacob@stdlib.com>
-api.stdlib.com
-
 // statichost.eu : https://www.statichost.eu
 // Submitted by Eric Selin <admin@statichost.eu>
 statichost.page
@@ -15908,10 +15878,6 @@ ipfs.w3s.link
 // Submitted by Tony Schirmer <tony@storebase.io>
 storebase.store
 
-// Storj Labs Inc. : https://storj.io/
-// Submitted by Philip Hutchins <hostmaster@storj.io>
-storj.farm
-
 // Strapi : https://strapi.io/
 // Submitted by Florent Baldino <security@strapi.io>
 strapiapp.com