@blamejs/core 0.18.40 → 0.18.42

package/lib/middleware/csrf-protect.js

@@ -69,6 +69,7 @@
  *   }
  */
 var C = require("../constants");
+var cookies = require("../cookies");
 var lazyRequire = require("../lazy-require");
 var pick = require("../pick");
 var forms = require("../forms");
@@ -130,33 +131,6 @@ function _parseCookieHeader(header) {
   return Object.assign(Object.create(null), Object.fromEntries(pairs));
 }
 
-function _formatSetCookie(name, value, opts) {
-  var parts = [name + "=" + value];
-  parts.push("Path=" + (opts.path || "/"));
-  parts.push("SameSite=" + (opts.sameSite || "Lax"));
-  if (opts.httpOnly) parts.push("HttpOnly");
-  if (opts.secure)   parts.push("Secure");
-  if (opts.maxAge != null) parts.push("Max-Age=" + opts.maxAge);
-  return parts.join("; ");
-}
-
-function _appendSetCookie(res, value) {
-  // Don't clobber other Set-Cookie headers the route may have already
-  // queued (login session cookie, etc.). Use res.appendHeader when
-  // available; else array-merge manually.
-  if (typeof res.appendHeader === "function") {
-    res.appendHeader("Set-Cookie", value);
-    return;
-  }
-  var existing = typeof res.getHeader === "function" ? res.getHeader("Set-Cookie") : undefined;
-  if (existing == null) {
-    res.setHeader("Set-Cookie", value);
-  } else if (Array.isArray(existing)) {
-    res.setHeader("Set-Cookie", existing.concat(value));
-  } else {
-    res.setHeader("Set-Cookie", [existing, value]);
-  }
-}
 
 // csrf-protect does NOT buffer or parse the request body itself.
 // Operators who use form-urlencoded POSTs MUST register
@@ -431,30 +405,44 @@ function create(opts) {
     if (["Lax", "Strict", "None"].indexOf(cookieCfg.sameSite) === -1) {
       throw new Error("middleware.csrfProtect: opts.cookie.sameSite must be Lax|Strict|None");
     }
-    // Cookie name-prefix safety (RFC 6265bis §4.1.3). csrf-protect builds its
-    // own Set-Cookie header rather than routing through b.cookies.serialize, so
-    // this boot check is the only enforcement point. §5.4 requires user agents
-    // to apply the prefix test case-INSENSITIVELY (the server-side §4.1.3
-    // description reads "case-sensitive", but the UA is what drops the cookie),
-    // so `__host-`/`__SECURE-` get the same browser enforcement as
-    // `__Host-`/`__Secure-` -- case-sensitive matching was itself CVE-2024-5699.
-    // Compare a lowercased copy so a case-variant name can't dodge the invariant
-    // here and then be silently rejected by the browser. Catch typos at boot.
+    // Cookie name-prefix safety (RFC 6265bis §4.1.3). b.cookies.serialize
+    // enforces the same invariants when the header is built, but that is a
+    // per-request throw inside the middleware; catching the bad configuration
+    // at boot turns it into a startup error the operator can read. §5.4
+    // requires user agents to apply the prefix test case-INSENSITIVELY (the
+    // server-side §4.1.3 description reads "case-sensitive", but the UA is what
+    // drops the cookie), so `__host-`/`__SECURE-` get the same browser
+    // enforcement as `__Host-`/`__Secure-` -- case-sensitive matching was itself
+    // CVE-2024-5699. Compare a lowercased copy so a case-variant name can't
+    // dodge the invariant here and then be silently rejected by the browser.
     //   __Host-*   — Path must be "/", no Domain (we never set one), Secure.
     //   __Secure-* — Secure.
     if (cookieCfg.name) {
       var lowerCookieName = cookieCfg.name.toLowerCase();
-      if (lowerCookieName.indexOf("__host-") === 0) {
-        if (cookieCfg.path !== "/") {
-          throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
-        }
-        if (cookieCfg.secure === false) {
-          throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
-        }
-      } else if (lowerCookieName.indexOf("__secure-") === 0) {
-        if (cookieCfg.secure === false) {
-          throw new Error("middleware.csrfProtect: __Secure-* cookie name requires secure (cannot be explicit false)");
-        }
+      var isHostPrefix   = lowerCookieName.indexOf("__host-") === 0;
+      var isSecurePrefix = lowerCookieName.indexOf("__secure-") === 0;
+      if (isHostPrefix && cookieCfg.path !== "/") {
+        throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
+      }
+      if (isHostPrefix && cookieCfg.secure === false) {
+        throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+      }
+      if (isSecurePrefix && cookieCfg.secure === false) {
+        throw new Error("middleware.csrfProtect: __Secure-* cookie name requires secure (cannot be explicit false)");
+      }
+      // A prefixed name is a promise to the browser that the cookie is always
+      // Secure. Leaving `secure` to per-request auto-detection breaks that
+      // promise on any cleartext request: the cookie goes out prefixed and
+      // WITHOUT Secure, the browser drops it, and the double-submit token
+      // silently never persists. The name and the auto-detect cannot both
+      // stand — the operator picking the prefix is the one asserting HTTPS,
+      // so make them say it.
+      if ((isHostPrefix || isSecurePrefix) && cookieCfg.secure == null) {
+        throw new Error("middleware.csrfProtect: " +
+          (isHostPrefix ? "__Host-*" : "__Secure-*") +
+          " cookie name requires an explicit cookie.secure: true — " +
+          "auto-detected secure emits the prefix without Secure on a plain-HTTP " +
+          "request, which browsers reject");
       }
     }
   }
@@ -485,8 +473,8 @@ function create(opts) {
   function _issueIfNeeded(req, res) {
     if (!cookieCfg) return null;
     var cookieName = _resolveCookieName(req);
-    var cookies = _parseCookieHeader(req.headers && req.headers.cookie);
-    var existing = cookies[cookieName];
+    var requestCookies = _parseCookieHeader(req.headers && req.headers.cookie);
+    var existing = requestCookies[cookieName];
     // Strict 64-hex-char check matches the byte-length of every token
     // forms.generateCsrfToken() produces (CSRF_TOKEN_BYTES = 32 bytes
     // → 64 hex chars). The previous {2,} floor accepted any 2-char
@@ -522,14 +510,20 @@ function create(opts) {
       } catch (_e) { /* drop-silent */ }
     }
     var fresh = forms.generateCsrfToken();
-    var setCookie = _formatSetCookie(cookieName, fresh, {
+    // b.cookies owns Set-Cookie: it validates the name as an RFC 6265 token,
+    // refuses CRLF / NUL in the value, scrubs the Path and Domain attributes
+    // before they reach a response header, and enforces the RFC 6265bis
+    // prefix invariants. The token is 64 hex characters, so the percent-
+    // encoding serialize applies to the value is a no-op on it and the cookie
+    // the browser echoes back still matches the double-submit compare.
+    var setCookie = cookies.serialize(cookieName, fresh, {
       path:     cookieCfg.path,
       sameSite: cookieCfg.sameSite,
       secure:   cookieCfg.secure == null ? _isHttps(req) : !!cookieCfg.secure,
       httpOnly: cookieCfg.httpOnly,
       maxAge:   cookieCfg.maxAge,
     });
-    _appendSetCookie(res, setCookie);
+    cookies.appendSetCookie(res, setCookie);
     req._csrfIssuedCookies[cookieName] = fresh;
     req.csrfToken = fresh;
     return fresh;

package/lib/migrations.js

@@ -297,12 +297,12 @@ function create(opts) {
   var dir = opts.dir;
 
   function _appliedRows() {
-    var db = _resolveDb(opts);
-    _ensureTable(db);
-    var q = sql.select(_migrationsTable(), _sqlOpts(db))
+    var conn = _resolveDb(opts);
+    _ensureTable(conn);
+    var q = sql.select(_migrationsTable(), _sqlOpts(conn))
       .columns(["name", "description", "appliedAt"])
       .orderBy("appliedAt", "asc").orderBy("name", "asc").toSql();
-    var stmt = db.prepare(q.sql);
+    var stmt = conn.prepare(q.sql);
     return stmt.all.apply(stmt, q.params);
   }
 
@@ -319,11 +319,11 @@ function create(opts) {
   }
 
   function up() {
-    var db = _resolveDb(opts);
-    _ensureTable(db);
-    return _withLock(db, opts, function () {
-      var namesQ = sql.select(_migrationsTable(), _sqlOpts(db)).columns(["name"]).toSql();
-      var namesStmt = db.prepare(namesQ.sql);
+    var conn = _resolveDb(opts);
+    _ensureTable(conn);
+    return _withLock(conn, opts, function () {
+      var namesQ = sql.select(_migrationsTable(), _sqlOpts(conn)).columns(["name"]).toSql();
+      var namesStmt = conn.prepare(namesQ.sql);
       var appliedSet = new Set(
         namesStmt.all.apply(namesStmt, namesQ.params)
           .map(function (r) { return r.name; })
@@ -336,12 +336,12 @@ function create(opts) {
         if (appliedSet.has(file)) { skipped.push(file); continue; }
         var mod = _loadMigration(file, dir);
         try {
-          _txn(db, function () {
-            mod.up(db);
-            var insQ = sql.insert(_migrationsTable(), _sqlOpts(db))
+          _txn(conn, function () {
+            mod.up(conn);
+            var insQ = sql.insert(_migrationsTable(), _sqlOpts(conn))
               .values({ name: file, description: mod.description || "",
                         appliedAt: new Date().toISOString() }).toSql();
-            var insStmt = db.prepare(insQ.sql);
+            var insStmt = conn.prepare(insQ.sql);
             insStmt.run.apply(insStmt, insQ.params);
           });
         } catch (e) {
@@ -363,16 +363,16 @@ function create(opts) {
         "down: steps must be a positive integer (got " + opts2.steps + ")",
         true);
     }
-    var db = _resolveDb(opts);
-    _ensureTable(db);
-    return _withLock(db, opts, function () {
+    var conn = _resolveDb(opts);
+    _ensureTable(conn);
+    return _withLock(conn, opts, function () {
       // Most-recent applied first (reverse chronological by appliedAt
       // then by name as a stable tiebreaker for fixtures with identical
       // timestamps). steps is a validated positive integer, so b.sql
       // inlines the LIMIT.
-      var downQ = sql.select(_migrationsTable(), _sqlOpts(db)).columns(["name"])
+      var downQ = sql.select(_migrationsTable(), _sqlOpts(conn)).columns(["name"])
         .orderBy("appliedAt", "desc").orderBy("name", "desc").limit(steps).toSql();
-      var downStmt = db.prepare(downQ.sql);
+      var downStmt = conn.prepare(downQ.sql);
       var rows = downStmt.all.apply(downStmt, downQ.params);
 
       var reverted = [];
@@ -386,10 +386,10 @@ function create(opts) {
             true);
         }
         try {
-          _txn(db, function () {
-            mod.down(db);
-            var delQ = sql.delete(_migrationsTable(), _sqlOpts(db)).where("name", file).toSql();
-            var delStmt = db.prepare(delQ.sql);
+          _txn(conn, function () {
+            mod.down(conn);
+            var delQ = sql.delete(_migrationsTable(), _sqlOpts(conn)).where("name", file).toSql();
+            var delStmt = conn.prepare(delQ.sql);
             delStmt.run.apply(delStmt, delQ.params);
           });
         } catch (e) {

package/lib/seeders.js

@@ -452,11 +452,11 @@ function create(opts) {
   function status(callerOpts) {
     callerOpts = callerOpts || {};
     _validateEnv("seeders.status: env", callerOpts.env);
-    var db = _resolveDb(opts);
-    _ensureTables(db);
+    var conn = _resolveDb(opts);
+    _ensureTables(conn);
     var env = callerOpts.env;
     var loaded = _loadAllForEnv(dir, env);
-    var applied = _appliedRows(db, env);
+    var applied = _appliedRows(conn, env);
     var appliedNames = new Set(applied.map(function (r) { return r.name; }));
     var pending = loaded.ordered.filter(function (n) {
       var mod = loaded.modByName[n];
@@ -491,8 +491,8 @@ function create(opts) {
       }
     }
 
-    var db = _resolveDb(opts);
-    _ensureTables(db);
+    var conn = _resolveDb(opts);
+    _ensureTables(conn);
 
     var loaded = _loadAllForEnv(dir, env);
 
@@ -504,11 +504,11 @@ function create(opts) {
     var startedAt = clock();
     observability().safeEvent("seeders.run.start", 1, { env: env, count: loaded.ordered.length });
 
-    var holder = _acquireLock(db, lockStaleAfterMs, clock);
+    var holder = _acquireLock(conn, lockStaleAfterMs, clock);
     try {
-      var appliedSelBuilt = sql.select(_seedersTable(), _sqlOpts(db))
+      var appliedSelBuilt = sql.select(_seedersTable(), _sqlOpts(conn))
         .columns(["name"]).where("env", env).toSql();
-      var appliedSelStmt = db.prepare(appliedSelBuilt.sql);
+      var appliedSelStmt = conn.prepare(appliedSelBuilt.sql);
       var appliedSet = new Set(
         appliedSelStmt.all.apply(appliedSelStmt, appliedSelBuilt.params)
           .map(function (r) { return r.name; })
@@ -539,26 +539,26 @@ function create(opts) {
           // Per-seed transaction: SQLite txns are sync, but the seed's
           // run() may be async — runInTransactionAsync wraps BEGIN/COMMIT
           // around the awaited body and rolls back this seed only on failure.
-          await dbSchema.runInTransactionAsync(db, async function () {
-            await mod.run(db, ctx);
+          await dbSchema.runInTransactionAsync(conn, async function () {
+            await mod.run(conn, ctx);
             var nowIso = new Date(clock()).toISOString();
             var writeBuilt;
             if (alreadyApplied && mod.rerunnable) {
-              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(conn))
                 .set({ appliedAt: nowIso, description: mod.description || "",
                        rerunnable: mod.rerunnable ? 1 : 0 })
                 .where("env", env).where("name", name).toSql();
             } else if (alreadyApplied && force) {
-              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(conn))
                 .set({ appliedAt: nowIso, description: mod.description || "" })
                 .where("env", env).where("name", name).toSql();
             } else {
-              writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
+              writeBuilt = sql.insert(_seedersTable(), _sqlOpts(conn))
                 .values({ env: env, name: name, description: mod.description || "",
                           appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
                 .toSql();
             }
-            var writeStmt = db.prepare(writeBuilt.sql);
+            var writeStmt = conn.prepare(writeBuilt.sql);
             writeStmt.run.apply(writeStmt, writeBuilt.params);
           }, {
             onRollbackFail: function (rollbackErr) {
@@ -629,7 +629,7 @@ function create(opts) {
       }
       return result;
     } finally {
-      _releaseLock(db, holder);
+      _releaseLock(conn, holder);
     }
   }
 

package/lib/session.js

@@ -54,6 +54,7 @@ var validateOpts = require("./validate-opts");
 var cluster = require("./cluster");
 var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
+var cookies = require("./cookies");
 var { generateToken, sha3Hash } = require("./crypto");
 var cryptoField = require("./crypto-field");
 var frameworkSchema = require("./framework-schema");
@@ -410,7 +411,9 @@ function _hashFingerprint(sid, inputs) {
  *     data:   { roles: ["admin"] },
  *     ttlMs:  b.constants.TIME.hours(8),
  *   });
- *   res.setHeader("Set-Cookie", "sid=" + s.token + "; HttpOnly; Secure; SameSite=Strict");
+ *   b.cookies.appendSetCookie(res, b.cookies.serialize("sid", s.token, {
+ *     httpOnly: true, secure: true, sameSite: "Strict", path: "/",
+ *   }));
  *   // → { token: "9f2c…", expiresAt: 1735689600000 }
  */
 // Anonymous-session prefix. b.session.create({ anonymous: true })
@@ -770,7 +773,9 @@ async function verify(token, verifyOpts) {
  *
  * @example
  *   await b.session.destroy(req.cookies.sid);
- *   res.setHeader("Set-Cookie", "sid=; HttpOnly; Max-Age=0");
+ *   b.cookies.appendSetCookie(res, b.cookies.serialize("sid", "", {
+ *     httpOnly: true, sameSite: "Strict", path: "/", maxAge: 0,
+ *   }));
  *   res.end("logged out");
  *   // → true
  */
@@ -798,13 +803,29 @@ async function destroy(token) {
  * this composes the secure-default logout the middleware otherwise had to be
  * mounted by hand. Returns whether a session was destroyed. Leader-only.
  *
+ * A browser deletes a cookie by MATCHING the expiry cookie's name, path and
+ * domain against the one in its jar, and it refuses a `Secure` cookie
+ * altogether when the response came over plain HTTP. So the expiry cookie has
+ * to describe the same scope the session cookie was written with, or the
+ * logout leaves it in place. Pass the `req` and the scheme is resolved through
+ * `b.requestHelpers.trustedProtocol` (a forwarded scheme counts only from a
+ * peer you declared trusted); pass `secure` to state it outright. With neither,
+ * the cookie is `Secure` — the secure default, unchanged.
+ *
  * @opts
- *   cookieName: string,    // default: "sid" — the session cookie to expire
- *   types:      string[],  // default: the W3C Clear-Site-Data directive set
+ *   cookieName:       string,   // default: "sid" — the session cookie to expire
+ *   types:            string[], // default: the W3C Clear-Site-Data directive set
+ *   req:              object,   // resolve Secure from this request's scheme
+ *   secure:           boolean,  // default: true — state the scheme outright
+ *   sameSite:         string,   // default: "Strict" — Strict / Lax / None
+ *   path:             string,   // default: "/" — must match the cookie's Path
+ *   domain:           string,   // must match the cookie's Domain, if it had one
+ *   trustedProxies:   string | string[],   // CIDRs, for the `req` scheme resolve
+ *   protocolResolver: function(req),       // own the scheme decision instead
  *
  * @example
  *   app.post("/logout", async function (req, res) {
- *     await b.session.logout(res, req.cookies.sid);
+ *     await b.session.logout(res, req.cookies.sid, { req: req });
  *     res.end("logged out");
  *   });
  *   // → emits Clear-Site-Data + expires the sid cookie + destroys the session
@@ -814,7 +835,19 @@ async function logout(res, token, opts) {
     throw new SessionError("session/bad-res",
       "b.session.logout: res must be an HTTP response with setHeader()");
   }
+  // The expiry cookie is queued with b.cookies.appendSetCookie, which needs to
+  // READ the response as well as write it. Assert that contract here, with the
+  // other validation, rather than discovering it at queue time: the queue
+  // happens after destroy(), so a throw there would leave the session revoked,
+  // Clear-Site-Data queued, no expiry cookie and a failed request. The
+  // response's shape is the caller's and fixed for the process, so it is
+  // knowable before any of that.
+  cookies.assertAppendable(res);
   opts = opts || {};
+  validateOpts(opts, [
+    "cookieName", "types", "req", "secure", "sameSite", "path", "domain",
+    "trustedProxies", "protocolResolver",
+  ], "b.session.logout");
   var cookieName = opts.cookieName === undefined ? "sid" : opts.cookieName;
   if (typeof cookieName !== "string" || cookieName.length === 0) {
     throw new SessionError("session/bad-cookie-name",
@@ -826,6 +859,19 @@ async function logout(res, token, opts) {
   // unknown directive throws here, queuing nothing.
   var clearSiteDataValue = csd.headerValue(types, "b.session.logout");
 
+  // Same ordering for the cookie: b.cookies.serialize validates the name, the
+  // attributes and the RFC 6265bis prefix invariants, so it is a throwing call
+  // and must run before the row is revoked — otherwise a `__Host-` typo leaves
+  // the session destroyed and the browser still holding its cookie.
+  var expiryCookie = cookies.serialize(cookieName, "", {
+    httpOnly: true,
+    secure:   _logoutCookieSecure(opts, cookieName),
+    sameSite: opts.sameSite === undefined ? "Strict" : opts.sameSite,
+    path:     opts.path === undefined ? "/" : opts.path,
+    domain:   opts.domain,
+    maxAge:   0,
+  });
+
   // Revoke the server-side session FIRST. If destroy() throws (a follower
   // failing cluster.requireLeader(), or a store/DB error), no client-wipe
   // headers have been queued — an error response can't then expire the
@@ -836,12 +882,55 @@ async function logout(res, token, opts) {
   // Now wipe the client-side state: W3C Clear-Site-Data (cookies /
   // storage / cache) + expire the session cookie (belt-and-suspenders with the
   // "cookies" directive, and effective even if the client ignores the header).
+  // Append rather than set: a route that already queued a cookie of its own
+  // (a rotated CSRF token, a locale) keeps it.
   res.setHeader("Clear-Site-Data", clearSiteDataValue);
-  res.setHeader("Set-Cookie",
-    cookieName + "=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0");
+  cookies.appendSetCookie(res, expiryCookie);
   return destroyed;
 }
 
+// Whether logout's expiry cookie carries Secure. Explicit `secure` wins; a
+// `req` resolves through the peer-gated protocol helper; with neither the
+// answer is the secure default. A browser drops a Secure cookie arriving over
+// plain HTTP, so answering "true" for an HTTP deployment does not fail safe —
+// it fails to clear the cookie at all.
+function _logoutCookieSecure(opts, cookieName) {
+  if (opts.secure !== undefined) {
+    if (typeof opts.secure !== "boolean") {
+      throw new SessionError("session/bad-secure",
+        "b.session.logout: opts.secure must be a boolean");
+    }
+    // An explicit `false` against a `__Host-`/`__Secure-` name is a
+    // contradiction, and serialize() refuses it. That is deliberate: the
+    // operator stated both halves, it fails on the first logout in every
+    // environment, and no request can provoke or avoid it.
+    return opts.secure;
+  }
+  // A `__Host-` / `__Secure-` name is a statement about the COOKIE, not about
+  // this request: a browser will only ever have stored such a cookie on a
+  // secure origin, so on a cleartext request there is nothing of that name to
+  // clear. Letting the request's scheme resolve `secure` to false here would
+  // make serialize() refuse the name — and the cookie is built BEFORE the row
+  // is revoked, so that refusal would abort the logout entirely and whoever
+  // chose the scheme would decide whether the session died. The prefix wins.
+  var lowerName = cookieName.toLowerCase();
+  if (lowerName.indexOf("__host-") === 0 || lowerName.indexOf("__secure-") === 0) {
+    return true;
+  }
+  if (opts.req === undefined) return true;
+  if (opts.req === null || typeof opts.req !== "object") {
+    // trustedProtocol answers "http" for a non-request rather than throwing, so
+    // a mistyped `req` would quietly drop Secure. Refuse it instead.
+    throw new SessionError("session/bad-req",
+      "b.session.logout: opts.req must be an HTTP request object");
+  }
+  var resolver = requestHelpers.trustedProtocol({
+    trustedProxies:   opts.trustedProxies,
+    protocolResolver: opts.protocolResolver,
+  });
+  return resolver.resolve(opts.req) === "https";
+}
+
 async function _deleteBySidHash(sidHash) {
   var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
     .where("sidHash", sidHash)
@@ -1057,7 +1146,9 @@ async function touch(token, opts) {
  *     reason: "mfa",
  *   });
  *   if (rotated) {
- *     res.setHeader("Set-Cookie", "sid=" + rotated.token + "; HttpOnly; Secure; SameSite=Strict");
+ *     b.cookies.appendSetCookie(res, b.cookies.serialize("sid", rotated.token, {
+ *       httpOnly: true, secure: true, sameSite: "Strict", path: "/",
+ *     }));
  *   }
  *   // → { token: "7a1e…", expiresAt: 1735689600000 }
  */

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-20T04:54:41.606Z"
+      "refreshedAt": "2026-08-20T15:14:48.311Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-20T04:54:41.606Z"
+      "refreshedAt": "2026-08-20T15:14:48.311Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-20T04:54:41.606Z",
+      "refreshedAt": "2026-08-20T15:14:48.311Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-20T04:54:41.606Z",
+      "refreshedAt": "2026-08-20T15:14:48.311Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-20T04:54:41.606Z"
+      "refreshedAt": "2026-08-20T15:14:48.311Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-20T04:54:41.606Z"
+      "refreshedAt": "2026-08-20T15:14:48.311Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-20T04:54:41.606Z"
+      "refreshedAt": "2026-08-20T15:14:48.311Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.16",
+      "version": "0.5.17",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -216,12 +216,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-19T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.16:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-20T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.17:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:96861fcf18c319d2e984cf48aaa0e496e903e447c491c6efcee677e15e87c24e"
+        "server": "sha256:dbedb80e1725747a24fdbd3dec9fcab31b507ac048b923462382b6ac117937a0"
       },
-      "refreshedAt": "2026-08-20T04:54:41.606Z"
+      "refreshedAt": "2026-08-20T15:14:48.311Z"
     }
   }
 }