@blamejs/core 0.18.35 → 0.18.37

package/lib/parsers/safe-yaml.js

@@ -59,6 +59,7 @@ var pick = require("../pick");
 var boundedMap = require("../bounded-map");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
+var codepointClass = require("../codepoint-class");
 var { FrameworkError } = require("../framework-error");
 
 class SafeYamlError extends FrameworkError {
@@ -93,14 +94,187 @@ var DEFAULTS = {
 // YAML 1.2 core-schema scalar resolution. Order matters: null first
 // (covers ~ and empty), then bool, then int (with base prefixes), then
 // float, then string fallback.
-var NULL_RE  = /^(null|Null|NULL|~|)$/;
-var BOOL_RE  = /^(true|True|TRUE|false|False|FALSE)$/;
-var INT_RE   = /^[-+]?(0|[1-9][0-9]*)$/;
-var INT_OCT  = /^0o[0-7]+$/;
-var INT_HEX  = /^0x[0-9a-fA-F]+$/;
-var FLOAT_RE = /^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$/;
-var FLOAT_INF = /^[-+]?\.(inf|Inf|INF)$/;
-var FLOAT_NAN = /^\.(nan|NaN|NAN)$/;
+// The resolvers are exact-set membership or a left-to-right walk. YAML's core
+// schema spells each type out, so none of these needs to search: the anchored
+// alternations were only ever a compact way of writing a fixed vocabulary and a
+// digit shape.
+var NULL_TOKENS = { "": 1, "null": 1, "Null": 1, "NULL": 1, "~": 1 };
+var BOOL_TRUE   = { "true": 1, "True": 1, "TRUE": 1 };
+var BOOL_FALSE  = { "false": 1, "False": 1, "FALSE": 1 };
+var INF_TOKENS  = { ".inf": 1, ".Inf": 1, ".INF": 1 };
+var NAN_TOKENS  = { ".nan": 1, ".NaN": 1, ".NAN": 1 };
+var OCTAL_DIGITS = "01234567";
+
+function _isNull(s) { return Object.prototype.hasOwnProperty.call(NULL_TOKENS, s); }
+function _isBool(s) {
+  return Object.prototype.hasOwnProperty.call(BOOL_TRUE, s) ||
+         Object.prototype.hasOwnProperty.call(BOOL_FALSE, s);
+}
+
+function _signOffset(s) { var c = s.charAt(0); return (c === "-" || c === "+") ? 1 : 0; }
+
+// `^[-+]?(0|[1-9][0-9]*)$` — no leading zeros, because `010` is a string in the
+// core schema rather than an octal.
+function _isDecimalInt(s) {
+  var i = _signOffset(s);
+  var rest = s.slice(i);
+  if (rest.length === 0) return false;
+  if (rest === "0") return true;
+  if (rest.charAt(0) === "0") return false;
+  return codepointClass.isRunOf(rest, codepointClass.ASCII_DIGITS);
+}
+
+function _isPrefixedInt(s, marker, alphabet) {
+  if (s.length < 3) return false;
+  if (s.charAt(0) !== "0" || s.charAt(1) !== marker) return false;
+  return codepointClass.isRunOf(s.slice(2), alphabet);
+}
+function _isOctalInt(s) { return _isPrefixedInt(s, "o", OCTAL_DIGITS); }
+function _isHexInt(s)   { return _isPrefixedInt(s, "x", codepointClass.ASCII_HEX); }
+
+// `^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$` — either a leading dot
+// with digits after it, or digits with an optional dot and optional digits, then
+// an optional exponent that must carry at least one digit.
+function _isFloat(s) {
+  var i = _signOffset(s);
+  var n = s.length;
+  // Both branches below return early when they find no digit, so reaching the
+  // exponent means at least one was consumed — no separate flag needed.
+  if (s.charAt(i) === ".") {
+    i += 1;
+    var fracStart = i;
+    while (i < n && codepointClass.ASCII_DIGITS.indexOf(s.charAt(i)) !== -1) i += 1;
+    if (i === fracStart) return false;              // `.` alone is not a float
+  } else {
+    var intStart = i;
+    while (i < n && codepointClass.ASCII_DIGITS.indexOf(s.charAt(i)) !== -1) i += 1;
+    if (i === intStart) return false;
+    if (s.charAt(i) === ".") {
+      i += 1;
+      while (i < n && codepointClass.ASCII_DIGITS.indexOf(s.charAt(i)) !== -1) i += 1;
+    }
+  }
+  if (i === n) return true;
+  var e = s.charAt(i);
+  if (e !== "e" && e !== "E") return false;
+  i += 1;
+  var expSign = s.charAt(i);
+  if (expSign === "+" || expSign === "-") i += 1;
+  if (i >= n) return false;
+  return codepointClass.isRunOf(s.slice(i), codepointClass.ASCII_DIGITS);
+}
+
+function _isInfinity(s) {
+  return Object.prototype.hasOwnProperty.call(INF_TOKENS, s.slice(_signOffset(s)));
+}
+function _isNotANumber(s) {
+  return Object.prototype.hasOwnProperty.call(NAN_TOKENS, s);
+}
+
+function _isWhitespaceChar(ch) {
+  return ch.length === 1 && codepointClass.inRanges(ch.charCodeAt(0), codepointClass.WHITESPACE_RANGES);
+}
+
+// The four characters `.` does not match without the `s` flag.
+function _isLineTerminator(ch) {
+  return ch === "\n" || ch === "\r" || ch === "\u2028" || ch === "\u2029";
+}
+
+// `^---(\s|$)` / `^\.\.\.(\s|$)` — a document marker is the three characters and
+// then either the end of the line or a space, so `---foo` is not one.
+function _isDocumentMarker(line, marker) {
+  if (line.slice(0, marker.length) !== marker) return false;
+  if (line.length === marker.length) return true;
+  return _isWhitespaceChar(line.charAt(marker.length));
+}
+
+// `^[|>][-+]?[0-9]?\s*$` and its variant allowing a trailing `# comment`.
+// A block-scalar header: the indicator, an optional chomping sign, an optional
+// single explicit-indent digit, then nothing that matters.
+function _isBlockScalarHeader(content, allowComment) {
+  var i = 0;
+  var lead = content.charAt(0);
+  if (lead !== "|" && lead !== ">") return false;
+  i += 1;
+  var sign = content.charAt(i);
+  if (sign === "-" || sign === "+") i += 1;
+  var digit = content.charAt(i);
+  if (digit.length === 1 && codepointClass.ASCII_DIGITS.indexOf(digit) !== -1) i += 1;
+  while (i < content.length && _isWhitespaceChar(content.charAt(i))) i += 1;
+  if (i === content.length) return true;
+  if (!allowComment) return false;
+  if (content.charAt(i) !== "#") return false;
+  // `.*` stops at a line terminator, and `$` without `m` is end-of-string, so a
+  // comment may not contain one. ECMAScript counts four, not just LF: U+2028 and
+  // U+2029 are line terminators to the grammar even though nothing else here
+  // treats them as breaks, and accepting them would admit a header the pattern
+  // refused.
+  var tail = content.slice(i);
+  for (var t = 0; t < tail.length; t += 1) {
+    if (_isLineTerminator(tail.charAt(t))) return false;
+  }
+  return true;
+}
+
+// `(^|\s)([&*])([A-Za-z0-9_][A-Za-z0-9_-]*)` — an anchor or alias sigil that
+// opens a token. Returns the index of the match INCLUDING the leading separator,
+// matching what the pattern captured, so the reported line is unchanged.
+var _NAME_HEAD = codepointClass.ASCII_ALNUM + "_";
+var _NAME_TAIL = codepointClass.ASCII_ALNUM + "_-";
+
+function _findAnchorOrAlias(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    var ch = text.charAt(i);
+    if (ch !== "&" && ch !== "*") continue;
+    var atStart = i === 0;
+    if (!atStart && !_isWhitespaceChar(text.charAt(i - 1))) continue;
+    if (_NAME_HEAD.indexOf(text.charAt(i + 1)) === -1 || text.charAt(i + 1) === "") continue;
+    return { index: atStart ? i : i - 1, sigil: ch };
+  }
+  return null;
+}
+
+// `(^|[\s-])(!{1,2}[A-Za-z<])` — one or two `!` opening a tag.
+function _findTag(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    if (text.charAt(i) !== "!") continue;
+    var atStart = i === 0;
+    var before = text.charAt(i - 1);
+    if (!atStart && !(before === "-" || _isWhitespaceChar(before))) continue;
+    // The pattern is greedy, so it takes two `!` when both are present.
+    var after = text.charAt(i + 1) === "!" ? text.charAt(i + 2) : text.charAt(i + 1);
+    if (after.length !== 1) continue;
+    // Digits count. The pattern this replaces used `[A-Za-z<]` while the comment
+    // above it said "alphanumeric or `<`", and the code was the weaker of the
+    // two: `a: !123` is a local tag and parsed as the plain string "!123"
+    // instead of being refused, so the documented ban had a hole in it. This is
+    // not a regression from the rewrite — `main` behaves the same way — but the
+    // promise is that tags are refused, so the stricter reading wins.
+    if (after !== "<" && codepointClass.ASCII_ALNUM.indexOf(after) === -1) continue;
+    return { index: atStart ? i : i - 1 };
+  }
+  return null;
+}
+
+// `(^|\n)%(YAML|TAG)\b` — a directive at column zero.
+var _DIRECTIVE_NAMES = ["YAML", "TAG"];
+
+function _findDirective(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    if (text.charAt(i) !== "%") continue;
+    var atStart = i === 0;
+    if (!atStart && text.charAt(i - 1) !== "\n") continue;
+    for (var d = 0; d < _DIRECTIVE_NAMES.length; d += 1) {
+      var name = _DIRECTIVE_NAMES[d];
+      if (text.slice(i + 1, i + 1 + name.length) !== name) continue;
+      // `\b` — the character after the name must not continue a word.
+      var next = text.charAt(i + 1 + name.length);
+      if (next.length === 1 && (_NAME_HEAD.indexOf(next) !== -1)) continue;
+      return { index: atStart ? i : i - 1, precededByNewline: !atStart };
+    }
+  }
+  return null;
+}
 
 function _resolveScalar(s) {
   // Fall back to string for any token whose length exceeds the scalar cap
@@ -109,31 +283,31 @@ function _resolveScalar(s) {
   // type-inference regexes never see a pathologically long string.
   if (typeof s !== "string" || s.length > MAX_SCALAR_BYTES) return s;
   // Below: every regex test sees an `s` whose s.length <= MAX_SCALAR_BYTES.
-  if (NULL_RE.test(s)) return null;
-  if (BOOL_RE.test(s)) return s.toLowerCase() === "true";
+  if (_isNull(s)) return null;
+  if (_isBool(s)) return s.toLowerCase() === "true";
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (INT_RE.test(s)) {
+  if (_isDecimalInt(s)) {
     var n = parseInt(s, 10);
     if (Number.isSafeInteger(n)) return n;
     return s;  // fallback to string for huge ints (don't lose precision silently)
   }
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (INT_OCT.test(s)) {
+  if (_isOctalInt(s)) {
     var oct = parseInt(s.substring(2), RADIX_OCTAL);
     if (Number.isSafeInteger(oct)) return oct;
     return s;
   }
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (INT_HEX.test(s)) {
+  if (_isHexInt(s)) {
     var hex = parseInt(s.substring(2), RADIX_HEX);
     if (Number.isSafeInteger(hex)) return hex;
     return s;
   }
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (FLOAT_INF.test(s)) return s.charAt(0) === "-" ? -Infinity : Infinity;
-  if (FLOAT_NAN.test(s)) return NaN;
+  if (_isInfinity(s)) return s.charAt(0) === "-" ? -Infinity : Infinity;
+  if (_isNotANumber(s)) return NaN;
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (FLOAT_RE.test(s)) {
+  if (_isFloat(s)) {
     var f = parseFloat(s);
     if (!isNaN(f)) return f;
   }
@@ -179,7 +353,9 @@ function parse(input, opts) {
   _preValidate(input);
 
   // Normalize line endings: CRLF / CR → LF for consistent line-based work.
-  input = input.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  // Normalise CRLF and lone CR to LF. splitLinesAny treats all three as one
+  // break, so rejoining with "\n" is the same substitution in one pass.
+  input = codepointClass.splitLinesAny(input).join("\n");
 
   // Split into raw lines preserving line numbers.
   var rawLines = input.split("\n");
@@ -212,11 +388,11 @@ function parse(input, opts) {
   // Reject any later `---` or `...` (multi-document streams not supported).
   var idx = 0;
   while (idx < lines.length && (lines[idx].isBlank || lines[idx].isComment)) idx += 1;
-  if (idx < lines.length && /^---(\s|$)/.test(lines[idx].content)) idx += 1;
+  if (idx < lines.length && _isDocumentMarker(lines[idx].content, "---")) idx += 1;
   // Subsequent doc markers anywhere = reject.
   for (var j = idx; j < lines.length; j++) {
     var c = lines[j].content;
-    if (/^---(\s|$)/.test(c) || /^\.\.\.(\s|$)/.test(c)) {
+    if (_isDocumentMarker(c, "---") || _isDocumentMarker(c, "...")) {
       throw new SafeYamlError(
         "multi-document YAML streams are not supported",
         "yaml/multi-document", lines[j].lineNumber, 1
@@ -277,7 +453,7 @@ function parse(input, opts) {
     }
 
     // Block scalar header: `|` or `>` (with optional chomp/indent indicator)
-    if (/^[|>][-+]?[0-9]?\s*(#.*)?$/.test(content)) {
+    if (_isBlockScalarHeader(content, true)) {
       return _parseBlockScalar(k, indent, content);
     }
 
@@ -398,7 +574,8 @@ function parse(input, opts) {
       // 1. if there's content after the colon, that's a flow value or
       //    a plain scalar continuation on the same line.
       // 2. otherwise the value lives on subsequent more-indented lines.
-      var afterColon = ln.content.substring(keyRange.valueStart).replace(/^[ \t]+/, "");
+      var afterColon = codepointClass.trimChars(
+        ln.content.substring(keyRange.valueStart), " \t", { trailing: false });
       // Strip end-of-line comment
       afterColon = _stripEolComment(afterColon);
       var value;
@@ -406,7 +583,7 @@ function parse(input, opts) {
         // Inline value on this line.
         if (afterColon.charAt(0) === "|" || afterColon.charAt(0) === ">") {
           // Block scalar header inline with key
-          if (!/^[|>][-+]?[0-9]?\s*$/.test(afterColon)) {
+          if (!_isBlockScalarHeader(afterColon, false)) {
             throw new SafeYamlError("malformed block scalar header",
               "yaml/bad-block-scalar", ln.lineNumber, ln.indent + 1);
           }
@@ -506,7 +683,8 @@ function parse(input, opts) {
       // branch below) using _parseFlowValue's end position, then return the value
       // via the direct parser so the shape is identical to the pre-existing path.
       var fend = _parseFlowValue(t, 0, lineNumber, col, 0).nextPos;
-      var afterFlow = t.slice(fend).replace(/^\s+/, "");
+      var afterFlow = codepointClass.trimRanges(
+        t.slice(fend), codepointClass.WHITESPACE_RANGES, { trailing: false });
       if (afterFlow.length > 0 && afterFlow.charAt(0) !== "#") {
         throw new SafeYamlError("unexpected content after flow collection",
           "yaml/trailing-content", lineNumber, col);
@@ -517,7 +695,8 @@ function parse(input, opts) {
     if (t.charAt(0) === '"') {
       var dq = _decodeDoubleQuoted(t, lineNumber, col);
       var afterDq = _trailingAfterQuoted(t, '"');
-      if (afterDq.length > 0 && afterDq.replace(/^\s+/, "") !== "") {
+      if (afterDq.length > 0 &&
+          codepointClass.trimRanges(afterDq, codepointClass.WHITESPACE_RANGES, { trailing: false }) !== "") {
         throw new SafeYamlError("unexpected content after quoted string",
           "yaml/trailing-content", lineNumber, col);
       }
@@ -759,7 +938,7 @@ function parse(input, opts) {
           }
           case "U": {
             var hex8 = raw.substring(i + 2, i + 10);
-            if (!/^[0-9a-fA-F]{8}$/.test(hex8)) {
+            if (hex8.length !== 8 || !codepointClass.isRunOf(hex8, codepointClass.ASCII_HEX)) {
               throw new SafeYamlError("bad \\U escape", "yaml/bad-escape", lineNumber, col + i);
             }
             var code = parseInt(hex8, RADIX_HEX);
@@ -904,7 +1083,7 @@ function parse(input, opts) {
 
     if (chomp === "-") {
       // strip — remove trailing newline(s)
-      body = body.replace(/\n+$/, "");
+      body = codepointClass.trimRanges(body, [0x0A], { leading: false });
     } else if (chomp === "+") {
       // keep — restore trailing blanks we popped
       body += "\n".repeat(trailingBlanks);
@@ -1026,14 +1205,12 @@ function _preValidate(input) {
   //   (or start of value position). A simple heuristic: any unescaped `&`
   //   that's followed by an identifier char and is preceded by space or
   //   line start is an anchor. Same for `*`.
-  var anchorOrAliasRe = /(^|\s)([&*])([A-Za-z0-9_][A-Za-z0-9_-]*)/;
-  var m = safe.match(anchorOrAliasRe);
+  var m = _findAnchorOrAlias(safe);
   if (m) {
-    var posIdx = safe.indexOf(m[0]);
-    var lineCount = safe.substring(0, posIdx).split("\n").length;
+    var lineCount = safe.substring(0, m.index).split("\n").length;
     throw new SafeYamlError(
-      m[2] === "&" ? "anchors are not supported" : "aliases are not supported",
-      m[2] === "&" ? "yaml/anchors-banned" : "yaml/aliases-banned",
+      m.sigil === "&" ? "anchors are not supported" : "aliases are not supported",
+      m.sigil === "&" ? "yaml/anchors-banned" : "yaml/aliases-banned",
       lineCount, 1
     );
   }
@@ -1041,21 +1218,17 @@ function _preValidate(input) {
   // Tags: `!` at start of value or after `: ` / `- `. False-positive risk:
   //   "key: !something" vs "key: ![bracket". We match `!` followed by
   //   alphanumeric or `<`.
-  var tagRe = /(^|[\s-])(!{1,2}[A-Za-z<])/;
-  var mt = safe.match(tagRe);
+  var mt = _findTag(safe);
   if (mt) {
-    var tagIdx = safe.indexOf(mt[0]);
-    var tagLine = safe.substring(0, tagIdx).split("\n").length;
+    var tagLine = safe.substring(0, mt.index).split("\n").length;
     throw new SafeYamlError("tags are not supported",
       "yaml/tags-banned", tagLine, 1);
   }
 
   // Directives: `%YAML` or `%TAG` at column 0
-  var dirRe = /(^|\n)%(YAML|TAG)\b/;
-  var md = safe.match(dirRe);
+  var md = _findDirective(safe);
   if (md) {
-    var dirIdx = safe.indexOf(md[0]);
-    var dirLine = safe.substring(0, dirIdx).split("\n").length + (md[1] === "\n" ? 1 : 0);
+    var dirLine = safe.substring(0, md.index).split("\n").length + (md.precededByNewline ? 1 : 0);
     throw new SafeYamlError("directives are not supported",
       "yaml/directives-banned", dirLine, 1);
   }

package/lib/standard-webhooks.js

@@ -158,17 +158,19 @@ function verify(opts) {
   var toSign = id + "." + ts + "." + bodyBuf.toString("utf8");
   var expected = nodeCrypto.createHmac("sha256", opts.secret).update(toSign).digest("base64");
   // Multi-version: signature header is `v1,<sig> v2,<sig>` etc.
+  // Every v1 signature in the header is compared, with no break: stopping at
+  // the first match let the response time report the POSITION of the matching
+  // signature within a multi-version header, which is a property of the
+  // sender's key rotation and not something a verifier should hand back.
   var parts = sigHeader.split(" ");
-  var any = false;
+  var offered = [];
   for (var p = 0; p < parts.length; p += 1) {
     var pair = parts[p].split(",");
     if (pair.length !== 2) continue;
     if (pair[0] !== "v1") continue;
-    if (bCrypto.timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(pair[1], "utf8"))) {
-      any = true;
-      break;
-    }
+    offered.push(Buffer.from(pair[1], "utf8"));
   }
+  var any = bCrypto.timingSafeEqualAny(Buffer.from(expected, "utf8"), offered);
   if (!any) {
     throw new StandardWebhooksError("standard-webhooks/bad-signature",
       "verify: no v1 signature matched");

package/lib/totp.js

@@ -282,6 +282,12 @@ function verify(secret, code, opts) {
   var userCode = String(code).replace(/[\s.\-_]/g, "").padStart(resolved.digits, "0");
   var userBuf = Buffer.from(userCode);
 
+  // Every step in the drift window is compared, even after one matches. Returning
+  // from inside the loop would make the response time report WHICH step matched,
+  // and that is the clock offset between the authenticator and the server — a
+  // value derived from the shared secret's timeline that a caller submitting
+  // codes can otherwise only guess at.
+  var matchedStep = null;
   for (var d = -resolved.driftSteps; d <= resolved.driftSteps; d++) {
     var step = currentStep + d;
     if (lastUsedStep !== null && step <= lastUsedStep) continue;     // reject replays at-or-below the last accepted step
@@ -293,11 +299,14 @@ function verify(secret, code, opts) {
     try { expected = _hotp(secret, step, resolved); }
     catch (_e) { return false; }
     var expectedBuf = Buffer.from(expected);
+    // The comparison is not guarded by `matchedStep === null` — that would
+    // short-circuit the call away once something matched, which is the early
+    // exit wearing a different syntax. The earliest match still wins.
     if (timingSafeEqual(expectedBuf, userBuf)) {
-      return step;
+      if (matchedStep === null) matchedStep = step;
     }
   }
-  return false;
+  return matchedStep === null ? false : matchedStep;
 }
 
 function uri(secret, account, opts) {

package/lib/webhook-hmac.js

@@ -197,17 +197,19 @@ function verify(opts) {
   var signed = Buffer.concat([Buffer.from(tsRaw + ".", "utf8"), bodyBuf]);
   var expected = bCrypto.hmac(secretBuf, signed, nodeAlg);
   var expectedBuf = Buffer.from(expected, "utf8");
-  var matched = false;
+  // Every offered signature is compared. The `break` this replaced ended the
+  // loop at the first match, so a header whose first signature matched
+  // answered sooner than one whose last did — the position of the sender's
+  // current key inside its rotation, reported by timing.
+  //
+  // timingSafeEqualAny applies the same length pre-check per candidate; a
+  // wrong-length candidate cannot be the digest (the hex length is fixed by
+  // the algorithm, and is not secret), so it leaks nothing.
+  var offeredBufs = [];
   for (var s = 0; s < sigs.length; s += 1) {
-    // timingSafeEqual requires equal-length inputs; a wrong-length candidate
-    // cannot be the digest (the hex length is fixed by the algorithm, and is
-    // not secret), so the length pre-check leaks nothing.
-    if (sigs[s].length === expected.length &&
-        bCrypto.timingSafeEqual(expectedBuf, Buffer.from(sigs[s], "utf8"))) {
-      matched = true;
-      break;
-    }
+    offeredBufs.push(Buffer.from(sigs[s], "utf8"));
   }
+  var matched = bCrypto.timingSafeEqualAny(expectedBuf, offeredBufs);
   if (!matched) {
     throw new WebhookHmacError("webhook-hmac/bad-signature",
       "verify: no '" + sigField + "' signature matched");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.35",
+  "version": "0.18.37",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2105a3fd-0629-4778-a83f-39c23801d347",
+  "serialNumber": "urn:uuid:446f4ad2-1001-404f-a62c-c116788ed0b8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-18T15:12:45.318Z",
+    "timestamp": "2026-08-19T02:55:12.713Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.35",
+      "bom-ref": "@blamejs/core@0.18.37",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.35",
+      "version": "0.18.37",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.35",
+      "purl": "pkg:npm/%40blamejs/core@0.18.37",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.35",
+      "ref": "@blamejs/core@0.18.37",
       "dependsOn": []
     }
   ]