@blamejs/core 0.18.50 → 0.18.51

package/lib/mail-bimi.js

@@ -54,6 +54,7 @@ var nodeCrypto = require("node:crypto");
 
 var asn1 = require("./asn1-der");
 var C = require("./constants");
+var codepointClass = require("./codepoint-class");
 var pick = require("./pick");
 var httpClient = require("./http-client");
 var lazyRequire = require("./lazy-require");
@@ -87,6 +88,57 @@ var BIMI_RECORD_MAX_BYTES = C.BYTES.kib(2);
 // refused at validate-time before any tokenization.
 var TINY_PS_MAX_BYTES = C.BYTES.kib(32);
 
+// The SVG namespace, which a root element carrying a prefix must bind that
+// prefix to before the document is treated as a logo.
+var SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+
+// An XML namespace prefix is an NCName: XML 1.0's Name grammar without the
+// colon. These are the 5th-edition NameStartChar ranges and the characters
+// NameChar adds once a name has started, written as CODE POINTS rather than as
+// a regular-expression character class for two reasons. Most of the boundaries
+// do not render, so a literal class would put invisible characters in this
+// file; and the grammar reaches past the basic plane, where a class over UTF-16
+// code units cannot follow it.
+//
+// "Non-ASCII" is not the rule, and treating it as one is what this replaces.
+// NameStartChar deliberately omits the C1 controls, most punctuation and the
+// surrogate block, so a prefix built from those is not a name however faithfully
+// the document then declares it.
+var NCNAME_START_RANGES = [
+  [0x41, 0x5A], 0x5F, [0x61, 0x7A],
+  [0xC0, 0xD6], [0xD8, 0xF6], [0xF8, 0x2FF],
+  [0x370, 0x37D], [0x37F, 0x1FFF],
+  [0x200C, 0x200D], [0x2070, 0x218F], [0x2C00, 0x2FEF],
+  [0x3001, 0xD7FF], [0xF900, 0xFDCF], [0xFDF0, 0xFFFD],
+  [0x10000, 0xEFFFF],
+];
+
+var NCNAME_TAIL_RANGES = [
+  0x2D, 0x2E, [0x30, 0x39], 0xB7, [0x300, 0x36F], [0x203F, 0x2040],
+];
+
+// Stepped by CODE POINT, so an astral name character is read as the single
+// character it is, and a lone surrogate is read as itself — which is in no
+// range, so it is refused.
+function _isNcName(s) {
+  if (s.length === 0) return false;
+  var started = false;
+  for (var i = 0; i < s.length; ) {
+    var cp = s.codePointAt(i);
+    i += cp > 0xFFFF ? 2 : 1;
+    var ok = codepointClass.inRanges(cp, NCNAME_START_RANGES) ||
+             (started && codepointClass.inRanges(cp, NCNAME_TAIL_RANGES));
+    if (!ok) return false;
+    started = true;
+  }
+  return true;
+}
+
+// Superseded by _isNcName above. Not re-typed on the way out: two of this
+// class's bounds are characters that do not render, so what follows is left
+// exactly as it was rather than reconstructed from a reading of it.
+// var NC_NAME_RE = /^[A-Za-z_€-￿][A-Za-z0-9._€-￿-]*$/;
+
 // VMC / CMC fetch cap. Production VMCs are typically ~10-20 KiB;
 // 256 KiB is a generous ceiling that still bounds the download against
 // pathological responses. Operators with a stricter posture pass
@@ -571,7 +623,13 @@ function _tokenizeTinyPsSvg(s) {
 // values are still accepted (the SVG profile is permissive on quoting).
 function _parseTinyPsAttrs(src) {
   var attrs = {};
-  var re = /([A-Za-z_:][A-Za-z0-9:._-]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/g;
+  // The lookbehind is what keeps this linear, and it is also what XML means: an
+  // attribute name starts after something that is not a name character. Without
+  // it the name can begin at every offset inside a long run of name characters,
+  // consuming the run each time before `\s*=\s*` fails — 397ms on a 32 KiB
+  // input against 0.6ms for a well-formed SVG of the same size. The bytes come
+  // from a logo fetched at a URL in the sender's own DNS record.
+  var re = /(?<![A-Za-z0-9:._-])([A-Za-z_:][A-Za-z0-9:._-]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/g;
   var m;
   while ((m = re.exec(src)) !== null) {
     var name = m[1];
@@ -1002,17 +1060,232 @@ function _extractBimiCertPolicy(cert) {
   return rv;
 }
 
+// Is this leaf an SVG document — that is, does its root element come next once
+// everything XML permits ahead of a root has been stepped over?
+//
+// A prefix window cannot answer that. XML puts no length on the prologue, so
+// whichever number is chosen a legal document can put its root past it; the
+// first attempt here read 64 characters and dropped any logo carrying the usual
+// SVG 1.1 DOCTYPE, whose root sits at 154. What XML does bound is the KIND of
+// thing allowed before the root: whitespace (markup whitespace covers the
+// byte-order mark too), the declaration, processing instructions, comments and
+// a DOCTYPE. Stepping over those is both more permissive than any window and
+// stricter than a substring search, which called a document an SVG because a
+// comment mentioned one.
+//
+// Every branch advances the cursor past a complete construct, so the walk is
+// linear in the leaf and an unterminated construct ends it rather than
+// restarting a scan.
+// One past the `>` that closes a DOCTYPE declaration opening at `at`, or -1 if
+// it never closes.
+//
+// Every character the declaration can end on — `>`, and the `[`/`]` of the
+// internal subset — is also a character it may legally CONTAIN, inside a quoted
+// external identifier, a quoted entity value, or a comment. So none of them can
+// be located by searching for the next occurrence:
+//
+//   <!DOCTYPE svg SYSTEM "urn:logo>v1">        the `>` is in the URI
+//   <!DOCTYPE svg SYSTEM "urn:logo[v1">        the `[` opens no subset
+//   <!DOCTYPE svg [ <!ENTITY x "a]b"> ]>       the `]` is in the value
+//
+// Each of those was a separate defect while the ends were found with separate
+// searches. They are one defect: the declaration ends at the first `>` that is
+// not inside a quoted literal, a comment, or the subset. Reading it once, with
+// that rule, answers all of them and the ones not listed. Every branch advances,
+// so the walk is linear in the declaration.
+// One past a quoted literal opening at `j`; 0 when none opens there, -1 when
+// one opens and never closes. Same three-valued answer for the two helpers
+// below, so a caller reads them the same way.
+function _skipQuotedLiteral(text, j) {
+  var ch = text.charAt(j);
+  if (ch !== "\"" && ch !== "'") return 0;
+  var end = text.indexOf(ch, j + 1);
+  return end === -1 ? -1 : end + 1;
+}
+
+// One past a comment or a processing instruction opening at `j`. These are the
+// two constructs that may appear almost anywhere in a prologue and may contain
+// anything, so every scan that looks for a delimiter has to step over them —
+// and each must step over the SAME set. Teaching one scanner about processing
+// instructions and not its neighbour is what produced this function: the
+// declaration knew about them and the internal subset did not, so a legal
+// `<?meta value]?>` inside a subset ended it early.
+function _skipCommentOrPi(text, j) {
+  if (text.startsWith("<!--", j)) {
+    // XML rules, not HTML: a certificate payload is an XML document, and the
+    // HTML reader closes a comment at `--!>` and abruptly at `<!-->`, neither
+    // of which XML has. Reading one grammar with the other's rules disagrees
+    // about where the document begins — it would take the text after an early
+    // close for a root element, and would end a comment XML says is open.
+    var endComment = markupTokenizer.xmlCommentEnd(text, j);
+    return endComment === -1 ? -1 : endComment;
+  }
+  if (text.startsWith("<?", j)) {
+    var endPi = text.indexOf("?>", j + 2);
+    return endPi === -1 ? -1 : endPi + 2;
+  }
+  return 0;
+}
+
+function _endOfDoctype(text, at) {
+  var j = at + 9;                                        // past "<!DOCTYPE"
+  while (j < text.length) {
+    if (text.charAt(j) === ">") return j + 1;
+    if (text.charAt(j) === "[") {
+      var endSubset = _endOfInternalSubset(text, j);
+      if (endSubset === -1) return -1;
+      j = endSubset + 1;
+      continue;
+    }
+    var skipped = _skipQuotedLiteral(text, j);
+    if (skipped === 0) skipped = _skipCommentOrPi(text, j);
+    if (skipped === -1) return -1;
+    j = skipped === 0 ? j + 1 : skipped;
+  }
+  return -1;
+}
+
+// The index of the `]` that closes a DOCTYPE's internal subset, given the index
+// of its `[`, or -1 if it never closes. Same rule as the declaration around it:
+// quoted runs and comments are stepped over rather than searched through.
+function _endOfInternalSubset(text, at) {
+  var j = at + 1;
+  while (j < text.length) {
+    if (text.charAt(j) === "]") return j;
+    var skipped = _skipQuotedLiteral(text, j);
+    if (skipped === 0) skipped = _skipCommentOrPi(text, j);
+    if (skipped === -1) return -1;
+    j = skipped === 0 ? j + 1 : skipped;
+  }
+  return -1;
+}
+
+// The characters that can END a tag name: whitespace before the attributes, the
+// slash of an empty element, or the tag's own close. A closed set, unlike the
+// set of characters that may CONTINUE an XML name.
+function _endsTagName(text, at) {
+  var ch = text.charAt(at);
+  return ch === ">" || ch === "/" || markupTokenizer.isMarkupSpace(text.charCodeAt(at));
+}
+
+// Does the text between the root's name and its `>` read as a start tag?
+//
+// The one structural rule worth testing here is where a `/` may appear: XML
+// allows it in exactly one position, against the `>`, closing an empty element.
+// Anywhere else outside a quoted value the text is not a start tag — both
+// `<x:svg xmlns:x="…"/garbage>` and `<x:svg xmlns:x="…"/ >` have a closing
+// bracket and a perfectly good namespace declaration, and neither is one.
+//
+// Quotes are tracked because a `/` inside an attribute value is data: every
+// namespace URI here contains several.
+//
+// This is deliberately NOT a full attribute-grammar check. The function it
+// serves decides WHICH ASN.1 leaf holds the logo; whether the document is
+// conformant is validateTinyPsSvg's question, and duplicating that here would
+// be a second, weaker parser drifting out of step with the real one.
+function _tagBodyIsWellFormed(text, from, tagEnd) {
+  var quote = "";
+  for (var i = from; i < tagEnd; i += 1) {
+    var ch = text.charAt(i);
+    if (quote) { if (ch === quote) quote = ""; continue; }
+    if (ch === "\"" || ch === "'") { quote = ch; continue; }
+    if (ch !== "/") continue;
+    // A slash outside a quoted value closes an empty element, and XML's
+    // EmptyElemTag is `S? '/>'` — the space may come BEFORE the slash and not
+    // after it, so the slash has to sit against the bracket.
+    return i + 1 === tagEnd;
+  }
+  // An unterminated quote means the tag never really ended either.
+  return quote === "";
+}
+
+function _svgRootFollowsPrologue(text) {
+  var i = 0;
+  for (;;) {
+    i = markupTokenizer.skipMarkupSpace(text, i);
+
+    // Comments and processing instructions, through the same definitions the
+    // two DOCTYPE scanners use. The XML declaration is a processing instruction
+    // as far as finding its end goes.
+    var aside = _skipCommentOrPi(text, i);
+    if (aside === -1) return false;
+    if (aside !== 0) { i = aside; continue; }
+
+    if (text.startsWith("<!DOCTYPE", i) || text.startsWith("<!doctype", i)) {
+      var endDoctype = _endOfDoctype(text, i);
+      if (endDoctype === -1) return false;
+      i = endDoctype;
+      continue;
+    }
+    break;
+  }
+
+  if (text.charAt(i) !== "<") return false;
+
+  // Read the whole root name and compare its LOCAL part.
+  //
+  // Two things this gets right that a `startsWith("<svg")` does not. `<svgfoo`
+  // and `<svg.foo` are different elements — and asking instead "does a name
+  // character follow?" is only as good as the character list, since XML's name
+  // grammar runs well past the ASCII set any such list holds, `.` alone being
+  // enough to let `<svg.foo` through. And an SVG may bind its own namespace to
+  // a prefix and write the root `<svg:svg>`, which is the same element.
+  //
+  // What is deliberately NOT done is resolving the prefix to a namespace URI. A
+  // logo that omits `xmlns` altogether is common and was accepted before, so
+  // requiring the binding here would reject real marks; this step is best-effort
+  // detection deciding which leaf to hand back, not validation.
+  var nameEnd = i + 1;
+  while (nameEnd < text.length && !_endsTagName(text, nameEnd)) nameEnd += 1;
+  if (nameEnd >= text.length) return false;          // the name never ends: truncated
+  // A qualified name is `prefix:local`, one colon, two parts.
+  // The start tag has to CLOSE. A tag name ends at the whitespace before the
+  // attributes, so a document whose bytes stop mid-tag still has a complete
+  // name — and, if it got as far as a namespace declaration, a perfectly good
+  // binding. That is a truncated document rather than a logo. scanToTagEnd
+  // reports the end of the input when it finds no `>`.
+  var tagEnd = markupTokenizer.scanToTagEnd(text, nameEnd, text.length);
+  if (tagEnd >= text.length) return false;
+  if (!_tagBodyIsWellFormed(text, nameEnd, tagEnd)) return false;
+
+  var parts = text.slice(i + 1, nameEnd).split(":");
+  if (parts.length > 2 || parts[parts.length - 1] !== "svg") return false;
+  // A prefix is an NCName, so a digit or a punctuation character cannot begin
+  // one. Without this a malformed name that declares a matching attribute —
+  // `<0ns:svg xmlns:0ns="...">` — would satisfy the binding check below, since
+  // attribute parsing is as permissive about names as this scan is.
+  if (parts.length === 2 && !_isNcName(parts[0])) return false;
+  // An unprefixed root is accepted without an `xmlns`: logos omit it, and the
+  // scanner this replaces accepted them.
+  if (parts.length === 1) return true;
+
+  // A prefix, though, means nothing until the root binds it. `<x:svg>` where
+  // `x` is another vocabulary is not an SVG, and one declared nowhere names
+  // nothing — so requiring the binding is what separates a namespaced root from
+  // arbitrary XML whose local name happens to read `svg`. It also settles the
+  // malformed names for free: `<a::svg` has too many parts, and `<a<:svg` and
+  // `<0ns:svg` declare no matching `xmlns:` attribute.
+  var attrs = markupTokenizer.parseAttrs(text.slice(nameEnd, tagEnd));
+  var wanted = "xmlns:" + parts[0];
+  for (var a = 0; a < attrs.length; a += 1) {
+    // The value is compared for what it DENOTES: an XML processor resolves
+    // `&#x73;vg` and `svg` to the same namespace, so comparing the lexical form
+    // would reject a root whose namespace is the SVG one.
+    if (attrs[a].name === wanted) {
+      return markupTokenizer.decodeCharRefs(attrs[a].value) === SVG_NAMESPACE;
+    }
+  }
+  return false;
+}
+
 function _scanForEmbeddedSvg(node, depthBudget) {
   if (!node) return null;
   if (depthBudget < 0) return null;
 
   if (!node.constructed) {
     if (!node.value || node.value.length < 4) return null;
-    var prefix = node.value.slice(0, Math.min(node.value.length, 64)).toString("utf8");   /* display truncation length, not bytes */
-    if (prefix.indexOf("<svg") !== -1 || /<\?xml[\s\S]*<svg/.test(prefix)) {
-      return node.value.toString("utf8");
-    }
-    return null;
+    var text = node.value.toString("utf8");
+    return _svgRootFollowsPrologue(text) ? text : null;
   }
 
   var children;

package/lib/markup-tokenizer.js

@@ -61,6 +61,92 @@ function splitTagNameAttrs(inner, tailChars) {
 var HTML_TAG_NAME_TAIL = codepointClass.ASCII_ALNUM + ":-";
 var XML_TAG_NAME_TAIL  = codepointClass.ASCII_ALNUM + ":-_";
 
+// The five entities XML predefines. Everything else in an attribute value is
+// either a numeric character reference or a reference to an entity a DTD
+// declared, which nothing here expands: an attribute value is compared, not
+// executed, and expanding declared entities is the door XXE comes through.
+var XML_PREDEFINED_REFS = {
+  amp: "&", lt: "<", gt: ">", quot: "\"", apos: "'",
+};
+
+var DEC_DIGITS_RE = /^[0-9]+$/;
+var HEX_DIGITS_RE = /^[0-9A-Fa-f]+$/;
+
+// U+10FFFF is six hex digits and 1114111 is seven decimal ones.
+var MAX_CHAR_REF_DIGITS = 7;   // digit count, not bytes
+
+// decodeCharRefs(s) — an attribute value with its numeric character references
+// and predefined entities resolved, so a value can be COMPARED against what it
+// denotes rather than against one spelling of it. `&#x73;vg` and `svg` are the
+// same namespace to an XML processor, and a scanner that compares the lexical
+// form disagrees with it.
+//
+// An unrecognized or malformed reference is left exactly as written rather than
+// dropped, so nothing a caller then matches on can be manufactured by deleting
+// characters. Returns the input unchanged when it holds no `&` at all.
+function decodeCharRefs(s) {
+  if (s.indexOf("&") === -1) return s;
+  var out = "";
+  var i = 0;
+  while (i < s.length) {
+    var amp = s.indexOf("&", i);
+    if (amp === -1) { out += s.slice(i); break; }
+    out += s.slice(i, amp);
+    var semi = s.indexOf(";", amp + 1);
+    if (semi === -1) { out += s.slice(amp); break; }
+    var body = s.slice(amp + 1, semi);
+    var decoded = null;
+    if (body.charAt(0) === "#") {
+      var hex = body.charAt(1) === "x" || body.charAt(1) === "X";
+      var digits = hex ? body.slice(2) : body.slice(1);
+      // XML puts no limit on leading zeros, so what gets bounded is the
+      // SIGNIFICANT digits, not the lexical run: a cap on the written form
+      // refuses `&#0000000104;`, which an XML processor resolves normally.
+      // Skipping the zeros is a plain index walk, so the unbounded part of the
+      // input never reaches a pattern. The largest code point is six hex digits
+      // or seven decimal ones, and a refused reference is left exactly as
+      // written, so bounding it cannot manufacture a match.
+      var firstSignificant = 0;
+      while (firstSignificant < digits.length - 1 &&
+             digits.charAt(firstSignificant) === "0") firstSignificant += 1;
+      var significant = digits.slice(firstSignificant);
+      var wellFormed = significant.length > 0 &&
+                       significant.length <= MAX_CHAR_REF_DIGITS &&
+                       (hex ? HEX_DIGITS_RE.test(significant) : DEC_DIGITS_RE.test(significant));
+      if (wellFormed) {
+        var cp = parseInt(significant, hex ? 16 : 10);
+        // A lone surrogate is not a character; neither is anything past the
+        // last plane, nor U+0000, which XML's Char production excludes. Each
+        // would either throw out of fromCodePoint or put a value in the string
+        // that no document can contain.
+        if (cp > 0 && cp <= 0x10FFFF && !(cp >= 0xD800 && cp <= 0xDFFF)) {
+          decoded = String.fromCodePoint(cp);
+        }
+      }
+    } else if (Object.prototype.hasOwnProperty.call(XML_PREDEFINED_REFS, body)) {
+      decoded = XML_PREDEFINED_REFS[body];
+    }
+    out += decoded === null ? s.slice(amp, semi + 1) : decoded;
+    i = semi + 1;
+  }
+  return out;
+}
+
+// xmlCommentEnd(s, lt) — the same question for an XML document, where the
+// answer is different. XML 1.0 §2.5 gives a comment exactly one terminator,
+// "-->": there is no "--!>" and no abrupt "<!-->" / "<!--->" close. So the two
+// grammars disagree in BOTH directions, and using the HTML reader on XML is a
+// parser differential either way — it ends a comment early and reads the text
+// after it as markup, and it ends one that XML says is still open.
+//
+// This module already names both tag-name grammars for the same reason; a
+// caller picks the one its document is written in rather than restating it.
+// Returns -1 when the comment is unterminated, as its HTML sibling does.
+function xmlCommentEnd(s, lt) {
+  var end = s.indexOf("-->", lt + 4);
+  return end === -1 ? -1 : end + 3;
+}
+
 // htmlCommentEnd(s, lt) — given that an HTML comment opens at index `lt`
 // (s.startsWith("<!--", lt)), return the index ONE PAST the comment's
 // terminator per the WHATWG HTML tokenizer, not just the legacy "-->" form.
@@ -233,6 +319,8 @@ module.exports = {
   scanToTagEnd: scanToTagEnd,
   splitTagNameAttrs: splitTagNameAttrs,
   htmlCommentEnd: htmlCommentEnd,
+  xmlCommentEnd: xmlCommentEnd,
+  decodeCharRefs: decodeCharRefs,
   HTML_TAG_NAME_TAIL: HTML_TAG_NAME_TAIL,
   XML_TAG_NAME_TAIL: XML_TAG_NAME_TAIL,
   isMarkupSpace: isMarkupSpace,

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z",
+      "refreshedAt": "2026-08-23T07:32:38.917Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z",
+      "refreshedAt": "2026-08-23T07:32:38.917Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.25",
+      "version": "0.5.28",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -216,12 +216,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-21T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.25:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-23T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.28:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:4e64654dfddb16742f615f24a4e8892286495d94ae29597cdc3e988122f3ef4a"
+        "server": "sha256:a11e84272034dc4065dac44f55b722b3b4e1803ddeb27b09cbe6d8644225209c"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     }
   }
 }