@blamejs/core 0.18.39 → 0.18.41

package/lib/public-suffix.js

@@ -74,6 +74,38 @@ function _err(code, message) {
   return new PublicSuffixError(code, message);
 }
 
+// The index of the first character that cannot appear in a host name, or -1.
+//
+// Control / NUL / whitespace bytes, DEL, and the URL-structural delimiters
+// domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
+// "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
+// which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
+// "[" / "]" already make domainToASCII return "", but they are rejected here
+// too so every non-host character fails closed rather than silently.
+//
+// Exported because it is the framework's definition of "a character that may
+// appear in a host", and the DNS wire encoder needs the same answer. When it
+// had its own — a shorter one — `b.network.dns` encoded `a\u0000.com` and
+// `example.com/evil` into query labels that this module refuses outright.
+function _firstNonHostCharacter(name) {
+  for (var i = 0; i < name.length; i += 1) {
+    var cp = name.charCodeAt(i);
+    if (cp < 0x21 || cp === 0x7f ||
+        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
+        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
+      return i;
+    }
+  }
+  return -1;
+}
+
+// The characters UTS #46 treats as a label separator, and therefore the ones
+// that can mark the root of an absolute name. Scanned against Node's own
+// mapping and found to be exactly this set across the BMP and the SMP.
+function _isRootMarker(ch) {
+  return ch === "." || ch === "。" || ch === "．" || ch === "｡";
+}
+
 // _normalizeInput — lowercase + IDN-normalize a candidate domain.
 // Returns a plain ASCII (punycode) string with no leading/trailing
 // dots and no empty labels. Throws PublicSuffixError on bad shape so
@@ -87,36 +119,41 @@ function _normalizeInput(domain) {
     throw _err("public-suffix/invalid-domain",
       "publicSuffix: domain must not be empty");
   }
-  if (domain.length > 253) {
-    // RFC 1035 §2.3.4 — 253 octets max for the wire form (255 minus
-    // length-byte + null). Anything longer is structurally invalid.
-    throw _err("public-suffix/invalid-domain",
-      "publicSuffix: domain exceeds 253-octet RFC 1035 limit");
-  }
-  // Strip a single trailing dot (FQDN form). Multiple trailing dots,
-  // leading dots, or embedded empty labels remain rejected below.
+  // Strip a single trailing root marker (FQDN form) BEFORE measuring. The
+  // absolute and relative spellings of one name encode to identical wire
+  // bytes, so measuring the marker would refuse a maximum-length name written
+  // absolutely while accepting it written relatively.
+  //
+  // Which character marks the root is not fixed: UTS #46 maps U+3002, U+FF0E
+  // and U+FF61 to "." as well, so `münchen.example。` is absolute too.
+  // Recognising all four here rather than only the ASCII dot is what lets the
+  // `rootStripped` guard below hold — exactly one marker comes off in total,
+  // and a second is an empty final label rather than something to remove.
+  //
+  // A marker that only APPEARS during conversion — because an IDNA-ignored
+  // code point trailed it — is handled by the post-conversion strip below,
+  // which the same guard keeps mutually exclusive with this one.
   var s = domain.toLowerCase();
-  if (s.charCodeAt(s.length - 1) === 46 /* "." */) {
+  var rootStripped = false;
+  if (_isRootMarker(s.charAt(s.length - 1))) {
     s = s.slice(0, -1);
+    rootStripped = true;
     if (s.length === 0) {
       throw _err("public-suffix/invalid-domain",
         "publicSuffix: domain must not be a bare dot");
     }
   }
-  // Reject control / null / whitespace bytes AND the URL-structural delimiters
-  // domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
-  // "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
-  // which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
-  // "[" / "]" already make domainToASCII return "" (caught below), but reject
-  // them here too so every non-host character fails closed, not silently.
-  for (var i = 0; i < s.length; i += 1) {
-    var cp = s.charCodeAt(i);
-    if (cp < 0x21 || cp === 0x7f ||
-        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
-        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
-      throw _err("public-suffix/invalid-domain",
-        "publicSuffix: domain contains a control byte or URL delimiter");
-    }
+  if (s.length > 253) {
+    // A cheap bound on the INPUT, so a pathological string is refused before
+    // conversion. It is not the authoritative check: an internationalized name
+    // grows when it becomes A-labels, so the real test is on the converted form
+    // below. Every ASCII name is settled here, since conversion leaves it as-is.
+    throw _err("public-suffix/invalid-domain",
+      "publicSuffix: domain exceeds 253-octet RFC 1035 limit");
+  }
+  if (_firstNonHostCharacter(s) !== -1) {
+    throw _err("public-suffix/invalid-domain",
+      "publicSuffix: domain contains a control byte or URL delimiter");
   }
   // IDN-normalize — non-ASCII labels become xn--… via Node's UTS #46
   // implementation. Empty string back means the input was malformed
@@ -126,11 +163,55 @@ function _normalizeInput(domain) {
     throw _err("public-suffix/invalid-domain",
       "publicSuffix: domain failed IDN normalization");
   }
-  // No empty labels (`foo..bar`) and no leading dot.
+  // No empty labels (`foo..bar`) and no leading dot. This runs BEFORE the
+  // root-marker strip below, so a name carrying an empty final label cannot be
+  // turned into a valid one by removing a dot: `münchen.example。。` converts to
+  // a trailing `..` and is refused here rather than quietly becoming a
+  // different, real domain.
   if (ascii.indexOf("..") !== -1 || ascii.charCodeAt(0) === 46) {
     throw _err("public-suffix/invalid-domain",
       "publicSuffix: domain contains empty label");
   }
+  // RFC 1035 §2.3.4 — 253 octets max for the wire form (255 minus the leading
+  // length byte and the root's null). This is the AUTHORITATIVE check, and it
+  // has to run on the converted name: an internationalized label grows into its
+  // `xn--` form, so five 44-character labels are 224 characters going in and
+  // 254 octets coming out, with every individual label a legal 50. Measuring
+  // the input handed the caller a name that cannot be put on the wire, and a
+  // caller cannot tell — it looks like any other domain, and the DMARC walk
+  // stepped over the unqueryable target and applied an ancestor's policy.
+  //
+  // A trailing root marker is still present at this point and does not count:
+  // the wire form carries the root as a zero-length label, not a character.
+  var withoutRoot = ascii.charCodeAt(ascii.length - 1) === 46
+    ? ascii.length - 1 : ascii.length;
+  if (withoutRoot > 253) {
+    throw _err("public-suffix/invalid-domain",
+      "publicSuffix: domain exceeds 253-octet RFC 1035 limit once converted " +
+      "to A-labels (" + withoutRoot + " octets)");
+  }
+  // The root marker is stripped here when it was not an ASCII dot on the way
+  // in. UTS #46 maps U+3002, U+FF0E and U+FF61 to ".", so `münchen.example。`
+  // arrives with no trailing dot and leaves the conversion with one. Returning
+  // that from a function whose contract is to strip the trailing dot leaves
+  // every caller to compensate, and the ones that do not compare two spellings
+  // of the same absolute name as different names.
+  //
+  // At most ONE root marker is removed in total. A dot still here after one was
+  // already taken off means the name ended in two of them — an empty final
+  // label — and stripping the second would hand the caller a different, valid
+  // domain than the one they asked about.
+  if (ascii.charCodeAt(ascii.length - 1) === 46 /* "." */) {
+    if (rootStripped) {
+      throw _err("public-suffix/invalid-domain",
+        "publicSuffix: domain contains empty label");
+    }
+    ascii = ascii.slice(0, -1);
+    if (ascii.length === 0) {
+      throw _err("public-suffix/invalid-domain",
+        "publicSuffix: domain must not be a bare dot");
+    }
+  }
   return ascii;
 }
 
@@ -462,4 +543,9 @@ module.exports = {
   canonicalDomain:      canonicalDomain,
   isPublicSuffix:       isPublicSuffix,
   lookupSource:         lookupSource,
+  _firstNonHostCharacter: _firstNonHostCharacter,
+  // Exported for the same reason as the character predicate above: this is the
+  // framework's answer to "which characters mark the root of an absolute name",
+  // and a second copy of the set drifts from it.
+  _isRootMarker:          _isRootMarker,
 };

package/lib/seeders.js

@@ -452,11 +452,11 @@ function create(opts) {
   function status(callerOpts) {
     callerOpts = callerOpts || {};
     _validateEnv("seeders.status: env", callerOpts.env);
-    var db = _resolveDb(opts);
-    _ensureTables(db);
+    var conn = _resolveDb(opts);
+    _ensureTables(conn);
     var env = callerOpts.env;
     var loaded = _loadAllForEnv(dir, env);
-    var applied = _appliedRows(db, env);
+    var applied = _appliedRows(conn, env);
     var appliedNames = new Set(applied.map(function (r) { return r.name; }));
     var pending = loaded.ordered.filter(function (n) {
       var mod = loaded.modByName[n];
@@ -491,8 +491,8 @@ function create(opts) {
       }
     }
 
-    var db = _resolveDb(opts);
-    _ensureTables(db);
+    var conn = _resolveDb(opts);
+    _ensureTables(conn);
 
     var loaded = _loadAllForEnv(dir, env);
 
@@ -504,11 +504,11 @@ function create(opts) {
     var startedAt = clock();
     observability().safeEvent("seeders.run.start", 1, { env: env, count: loaded.ordered.length });
 
-    var holder = _acquireLock(db, lockStaleAfterMs, clock);
+    var holder = _acquireLock(conn, lockStaleAfterMs, clock);
     try {
-      var appliedSelBuilt = sql.select(_seedersTable(), _sqlOpts(db))
+      var appliedSelBuilt = sql.select(_seedersTable(), _sqlOpts(conn))
         .columns(["name"]).where("env", env).toSql();
-      var appliedSelStmt = db.prepare(appliedSelBuilt.sql);
+      var appliedSelStmt = conn.prepare(appliedSelBuilt.sql);
       var appliedSet = new Set(
         appliedSelStmt.all.apply(appliedSelStmt, appliedSelBuilt.params)
           .map(function (r) { return r.name; })
@@ -539,26 +539,26 @@ function create(opts) {
           // Per-seed transaction: SQLite txns are sync, but the seed's
           // run() may be async — runInTransactionAsync wraps BEGIN/COMMIT
           // around the awaited body and rolls back this seed only on failure.
-          await dbSchema.runInTransactionAsync(db, async function () {
-            await mod.run(db, ctx);
+          await dbSchema.runInTransactionAsync(conn, async function () {
+            await mod.run(conn, ctx);
             var nowIso = new Date(clock()).toISOString();
             var writeBuilt;
             if (alreadyApplied && mod.rerunnable) {
-              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(conn))
                 .set({ appliedAt: nowIso, description: mod.description || "",
                        rerunnable: mod.rerunnable ? 1 : 0 })
                 .where("env", env).where("name", name).toSql();
             } else if (alreadyApplied && force) {
-              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(conn))
                 .set({ appliedAt: nowIso, description: mod.description || "" })
                 .where("env", env).where("name", name).toSql();
             } else {
-              writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
+              writeBuilt = sql.insert(_seedersTable(), _sqlOpts(conn))
                 .values({ env: env, name: name, description: mod.description || "",
                           appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
                 .toSql();
             }
-            var writeStmt = db.prepare(writeBuilt.sql);
+            var writeStmt = conn.prepare(writeBuilt.sql);
             writeStmt.run.apply(writeStmt, writeBuilt.params);
           }, {
             onRollbackFail: function (rollbackErr) {
@@ -629,7 +629,7 @@ function create(opts) {
       }
       return result;
     } finally {
-      _releaseLock(db, holder);
+      _releaseLock(conn, holder);
     }
   }
 

package/lib/session.js

@@ -54,6 +54,7 @@ var validateOpts = require("./validate-opts");
 var cluster = require("./cluster");
 var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
+var cookies = require("./cookies");
 var { generateToken, sha3Hash } = require("./crypto");
 var cryptoField = require("./crypto-field");
 var frameworkSchema = require("./framework-schema");
@@ -410,7 +411,9 @@ function _hashFingerprint(sid, inputs) {
  *     data:   { roles: ["admin"] },
  *     ttlMs:  b.constants.TIME.hours(8),
  *   });
- *   res.setHeader("Set-Cookie", "sid=" + s.token + "; HttpOnly; Secure; SameSite=Strict");
+ *   b.cookies.appendSetCookie(res, b.cookies.serialize("sid", s.token, {
+ *     httpOnly: true, secure: true, sameSite: "Strict", path: "/",
+ *   }));
  *   // → { token: "9f2c…", expiresAt: 1735689600000 }
  */
 // Anonymous-session prefix. b.session.create({ anonymous: true })
@@ -770,7 +773,9 @@ async function verify(token, verifyOpts) {
  *
  * @example
  *   await b.session.destroy(req.cookies.sid);
- *   res.setHeader("Set-Cookie", "sid=; HttpOnly; Max-Age=0");
+ *   b.cookies.appendSetCookie(res, b.cookies.serialize("sid", "", {
+ *     httpOnly: true, sameSite: "Strict", path: "/", maxAge: 0,
+ *   }));
  *   res.end("logged out");
  *   // → true
  */
@@ -798,13 +803,29 @@ async function destroy(token) {
  * this composes the secure-default logout the middleware otherwise had to be
  * mounted by hand. Returns whether a session was destroyed. Leader-only.
  *
+ * A browser deletes a cookie by MATCHING the expiry cookie's name, path and
+ * domain against the one in its jar, and it refuses a `Secure` cookie
+ * altogether when the response came over plain HTTP. So the expiry cookie has
+ * to describe the same scope the session cookie was written with, or the
+ * logout leaves it in place. Pass the `req` and the scheme is resolved through
+ * `b.requestHelpers.trustedProtocol` (a forwarded scheme counts only from a
+ * peer you declared trusted); pass `secure` to state it outright. With neither,
+ * the cookie is `Secure` — the secure default, unchanged.
+ *
  * @opts
- *   cookieName: string,    // default: "sid" — the session cookie to expire
- *   types:      string[],  // default: the W3C Clear-Site-Data directive set
+ *   cookieName:       string,   // default: "sid" — the session cookie to expire
+ *   types:            string[], // default: the W3C Clear-Site-Data directive set
+ *   req:              object,   // resolve Secure from this request's scheme
+ *   secure:           boolean,  // default: true — state the scheme outright
+ *   sameSite:         string,   // default: "Strict" — Strict / Lax / None
+ *   path:             string,   // default: "/" — must match the cookie's Path
+ *   domain:           string,   // must match the cookie's Domain, if it had one
+ *   trustedProxies:   string | string[],   // CIDRs, for the `req` scheme resolve
+ *   protocolResolver: function(req),       // own the scheme decision instead
  *
  * @example
  *   app.post("/logout", async function (req, res) {
- *     await b.session.logout(res, req.cookies.sid);
+ *     await b.session.logout(res, req.cookies.sid, { req: req });
  *     res.end("logged out");
  *   });
  *   // → emits Clear-Site-Data + expires the sid cookie + destroys the session
@@ -814,7 +835,19 @@ async function logout(res, token, opts) {
     throw new SessionError("session/bad-res",
       "b.session.logout: res must be an HTTP response with setHeader()");
   }
+  // The expiry cookie is queued with b.cookies.appendSetCookie, which needs to
+  // READ the response as well as write it. Assert that contract here, with the
+  // other validation, rather than discovering it at queue time: the queue
+  // happens after destroy(), so a throw there would leave the session revoked,
+  // Clear-Site-Data queued, no expiry cookie and a failed request. The
+  // response's shape is the caller's and fixed for the process, so it is
+  // knowable before any of that.
+  cookies.assertAppendable(res);
   opts = opts || {};
+  validateOpts(opts, [
+    "cookieName", "types", "req", "secure", "sameSite", "path", "domain",
+    "trustedProxies", "protocolResolver",
+  ], "b.session.logout");
   var cookieName = opts.cookieName === undefined ? "sid" : opts.cookieName;
   if (typeof cookieName !== "string" || cookieName.length === 0) {
     throw new SessionError("session/bad-cookie-name",
@@ -826,6 +859,19 @@ async function logout(res, token, opts) {
   // unknown directive throws here, queuing nothing.
   var clearSiteDataValue = csd.headerValue(types, "b.session.logout");
 
+  // Same ordering for the cookie: b.cookies.serialize validates the name, the
+  // attributes and the RFC 6265bis prefix invariants, so it is a throwing call
+  // and must run before the row is revoked — otherwise a `__Host-` typo leaves
+  // the session destroyed and the browser still holding its cookie.
+  var expiryCookie = cookies.serialize(cookieName, "", {
+    httpOnly: true,
+    secure:   _logoutCookieSecure(opts, cookieName),
+    sameSite: opts.sameSite === undefined ? "Strict" : opts.sameSite,
+    path:     opts.path === undefined ? "/" : opts.path,
+    domain:   opts.domain,
+    maxAge:   0,
+  });
+
   // Revoke the server-side session FIRST. If destroy() throws (a follower
   // failing cluster.requireLeader(), or a store/DB error), no client-wipe
   // headers have been queued — an error response can't then expire the
@@ -836,12 +882,55 @@ async function logout(res, token, opts) {
   // Now wipe the client-side state: W3C Clear-Site-Data (cookies /
   // storage / cache) + expire the session cookie (belt-and-suspenders with the
   // "cookies" directive, and effective even if the client ignores the header).
+  // Append rather than set: a route that already queued a cookie of its own
+  // (a rotated CSRF token, a locale) keeps it.
   res.setHeader("Clear-Site-Data", clearSiteDataValue);
-  res.setHeader("Set-Cookie",
-    cookieName + "=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0");
+  cookies.appendSetCookie(res, expiryCookie);
   return destroyed;
 }
 
+// Whether logout's expiry cookie carries Secure. Explicit `secure` wins; a
+// `req` resolves through the peer-gated protocol helper; with neither the
+// answer is the secure default. A browser drops a Secure cookie arriving over
+// plain HTTP, so answering "true" for an HTTP deployment does not fail safe —
+// it fails to clear the cookie at all.
+function _logoutCookieSecure(opts, cookieName) {
+  if (opts.secure !== undefined) {
+    if (typeof opts.secure !== "boolean") {
+      throw new SessionError("session/bad-secure",
+        "b.session.logout: opts.secure must be a boolean");
+    }
+    // An explicit `false` against a `__Host-`/`__Secure-` name is a
+    // contradiction, and serialize() refuses it. That is deliberate: the
+    // operator stated both halves, it fails on the first logout in every
+    // environment, and no request can provoke or avoid it.
+    return opts.secure;
+  }
+  // A `__Host-` / `__Secure-` name is a statement about the COOKIE, not about
+  // this request: a browser will only ever have stored such a cookie on a
+  // secure origin, so on a cleartext request there is nothing of that name to
+  // clear. Letting the request's scheme resolve `secure` to false here would
+  // make serialize() refuse the name — and the cookie is built BEFORE the row
+  // is revoked, so that refusal would abort the logout entirely and whoever
+  // chose the scheme would decide whether the session died. The prefix wins.
+  var lowerName = cookieName.toLowerCase();
+  if (lowerName.indexOf("__host-") === 0 || lowerName.indexOf("__secure-") === 0) {
+    return true;
+  }
+  if (opts.req === undefined) return true;
+  if (opts.req === null || typeof opts.req !== "object") {
+    // trustedProtocol answers "http" for a non-request rather than throwing, so
+    // a mistyped `req` would quietly drop Secure. Refuse it instead.
+    throw new SessionError("session/bad-req",
+      "b.session.logout: opts.req must be an HTTP request object");
+  }
+  var resolver = requestHelpers.trustedProtocol({
+    trustedProxies:   opts.trustedProxies,
+    protocolResolver: opts.protocolResolver,
+  });
+  return resolver.resolve(opts.req) === "https";
+}
+
 async function _deleteBySidHash(sidHash) {
   var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
     .where("sidHash", sidHash)
@@ -1057,7 +1146,9 @@ async function touch(token, opts) {
  *     reason: "mfa",
  *   });
  *   if (rotated) {
- *     res.setHeader("Set-Cookie", "sid=" + rotated.token + "; HttpOnly; Secure; SameSite=Strict");
+ *     b.cookies.appendSetCookie(res, b.cookies.serialize("sid", rotated.token, {
+ *       httpOnly: true, secure: true, sameSite: "Strict", path: "/",
+ *     }));
  *   }
  *   // → { token: "7a1e…", expiresAt: 1735689600000 }
  */

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-19T07:22:41.105Z"
+      "refreshedAt": "2026-08-20T04:54:41.606Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-19T07:22:41.105Z"
+      "refreshedAt": "2026-08-20T04:54:41.606Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-19T07:22:41.105Z",
+      "refreshedAt": "2026-08-20T04:54:41.606Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-19T07:22:41.105Z",
+      "refreshedAt": "2026-08-20T04:54:41.606Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-19T07:22:41.105Z"
+      "refreshedAt": "2026-08-20T04:54:41.606Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-19T07:22:41.105Z"
+      "refreshedAt": "2026-08-20T04:54:41.606Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -186,17 +186,17 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-08-17T00:00:00Z",
+      "bundledAt": "2026-08-19T00:00:00Z",
       "hashes": {
-        "server": "sha256:f7e24ebb8ef6a366c52d2abc66275f68f64255f2650cda0c506035a92cff049a",
-        "data_js": "sha256:4b54a31c8697ee4509a3e1efbee3d155f276a29e15a135d550874024f4780266"
+        "server": "sha256:75142784c0308c8f7cd27f15fca80b9ddc09aeec05ae51c2f54fd0958351d9ad",
+        "data_js": "sha256:2435668e6d9964d95b283e5796938aa7c626ea0ca1eed4af8b1abec034f1761b"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-19T07:22:41.105Z"
+      "refreshedAt": "2026-08-20T04:54:41.606Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.11",
+      "version": "0.5.16",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -217,11 +217,11 @@
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
       "bundledAt": "2026-08-19T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.11:*:*:*:*:node.js:*:*",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.16:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:dfcaa10473eb0980958b1c6a4019114c69260191899edd5dc596605f21543249"
+        "server": "sha256:96861fcf18c319d2e984cf48aaa0e496e903e447c491c6efcee677e15e87c24e"
       },
-      "refreshedAt": "2026-08-19T07:22:41.105Z"
+      "refreshedAt": "2026-08-20T04:54:41.606Z"
     }
   }
 }