@blamejs/core 0.18.51 → 0.18.54

package/lib/middleware/headers.js

@@ -35,6 +35,7 @@
  *   });
  */
 
+var codepointClass = require("../codepoint-class");
 var lazyRequire = require("../lazy-require");
 var safeBuffer = require("../safe-buffer");
 
@@ -104,16 +105,12 @@ function _detectIssues(headers, opts) {
         });
         continue;
       }
-      for (var ci = 0; ci < v.length; ci += 1) {
-        var cc = v.charCodeAt(ci);
-        if (cc === 0x0D || cc === 0x0A || cc === 0x00) {                         // CR / LF / NUL forbidden in header value
-          issues.push({
-            kind: "header-value-control-byte", severity: "high", header: name,
-            snippet: "header `" + name + "` value contains CR / LF / NUL " +
-                     "— header-injection defense in depth",
-          });
-          break;
-        }
+      if (codepointClass.firstLineInjectionCharOffset(v) !== -1) {
+        issues.push({
+          kind: "header-value-control-byte", severity: "high", header: name,
+          snippet: "header `" + name + "` value contains CR / LF / NUL " +
+                   "— header-injection defense in depth",
+        });
       }
     }
   }

package/lib/network-dns-resolver.js

@@ -402,7 +402,21 @@ function create(opts) {
 
     if (parsed.rcode !== 0) {
       // RFC 1035 §4.1.1 — non-zero RCODE. Surface and refuse caching.
-      throw new ResolverError("resolver/nxdomain-or-error",
+      //
+      // NXDOMAIN and everything else are DIFFERENT ANSWERS and no longer share
+      // a code. NXDOMAIN (RCODE 3) means the name does not exist, which for a
+      // policy fetch or a blocklist is the ordinary case: no MTA-STS record, not
+      // on the list. SERVFAIL and REFUSED mean the question was not answered,
+      // and reading those as absence is a downgrade an attacker can arrange —
+      // break the lookup and the policy that would have refused you disappears.
+      //
+      // One code called `nxdomain-or-error` forced both readings on every
+      // caller, and both callers picked absence: `safeResolveTxt` could not
+      // match it at all so the commonest form of absence threw, and `b.mail.rbl`
+      // matched it and returned "not listed" for a lookup that failed.
+      var absent = parsed.rcode === 3;                                   // RFC 1035 §4.1.1 NXDOMAIN
+      throw new ResolverError(
+        absent ? "resolver/nxdomain" : "resolver/query-failed",
         "query: upstream RCODE=" + parsed.rcode + " for " + name + "/" + qtype);
     }
 
@@ -501,6 +515,12 @@ function create(opts) {
     queryCname:   _typed("CNAME"),
     queryMx:      _typed("MX"),
     queryNs:      _typed("NS"),
+    // PTR was the one common type with no helper, though it has been in
+    // QTYPE_BY_NAME all along. `b.mail.helo` called `resolver.queryPtr` for its
+    // forward-confirmed reverse DNS check, got `undefined`, and the resulting
+    // TypeError landed in a catch written for NXDOMAIN — so the check reported
+    // a clean "no reverse name" for every address instead of a broken call.
+    queryPtr:     _typed("PTR"),
     queryTxt:     _typed("TXT"),
     querySrv:     _typed("SRV"),
     queryTlsa:    _typed("TLSA"),
@@ -533,12 +553,31 @@ function _defaultTransport(timeoutMs) {
 async function _wireLookup(name, qtype, timeoutMs) {
   var ms = typeof timeoutMs === "number" && isFinite(timeoutMs) && timeoutMs > 0
     ? timeoutMs : DEFAULT_TIMEOUT_MS;
-  var url = networkDns._getDohUrlForTest ? networkDns._getDohUrlForTest() : "https://cloudflare-dns.com/dns-query";
+  // Where the deployment's DoH actually points. This used to be a hardcoded
+  // public provider, so an operator who had configured DoH to their own
+  // resolver still had every resolver.query() leave for the public one — and
+  // any statement they made about that resolver (that it validates DNSSEC, that
+  // it serves a split-horizon zone) described a resolver the query never
+  // reached. b.mail.send.deliver's `policy.dnssecValidated` is exactly such a
+  // statement. The endpoint is read per lookup rather than captured at create,
+  // so a later useDnsOverHttps reaches the next query instead of a handle's
+  // whole lifetime being pinned to boot-time configuration.
+  var endpoint = networkDns.activeDohEndpoint();
+  var url = (endpoint && endpoint.url) || "https://cloudflare-dns.com/dns-query";
   // Encode a wire-format query for the target qtype.
   var qbuf = _encodeWireQuery(name, qtype);
   var b64 = bCrypto.toBase64Url(qbuf);
   var getUrl = url + (url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
-  var u = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
+  // RFC 8484 §4.1 — GET carries the query in the URL, POST in the body. An
+  // endpoint may accept only POST, and `useDnsOverHttps({ method })` says so;
+  // honouring the operator's URL while ignoring their method leaves that
+  // endpoint unusable. With no method configured the choice falls to URL
+  // length, using the threshold b.network.dns owns rather than a second copy
+  // of the number.
+  var maxGet = (endpoint && endpoint.getUrlMaxBytes) || 2048;                                            // RFC 9112 §3-conservative GET ceiling
+  var usePost = (endpoint && endpoint.method === "POST") ||
+                (!(endpoint && endpoint.method) && getUrl.length > maxGet);
+  var u = safeUrl.parse(usePost ? url : getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
     var settled = false;
     function _fail(err) {
@@ -555,13 +594,23 @@ async function _wireLookup(name, qtype, timeoutMs) {
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
-    var req = https.request(Object.assign({                                                              // allow:raw-outbound-http-framework-internal — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
+    // The operator's CA travels with the endpoint. A private DoH resolver is
+    // usually issued by a private CA, so honouring the URL without the trust
+    // anchor that validates it would swap one unreachable endpoint for another.
+    var headers = { "accept": "application/dns-message" };
+    if (usePost) {
+      headers["content-type"]   = "application/dns-message";
+      headers["content-length"] = String(qbuf.length);
+    }
+    var reqOpts = Object.assign({
       hostname:   u.hostname,
       port:       u.port || 443,                                                                        // HTTPS port
       path:       u.pathname + u.search,
-      method:     "GET",
-      headers:    { "accept": "application/dns-message" },
-    }, networkTls().outboundPosture()), function (res) {
+      method:     usePost ? "POST" : "GET",
+      headers:    headers,
+    }, networkTls().outboundPosture());
+    if (endpoint && endpoint.ca) reqOpts.ca = endpoint.ca;
+    var req = https.request(reqOpts, function (res) {                                                    // allow:raw-outbound-http-framework-internal — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
       var collector = safeBuffer.boundedChunkCollector({
         maxBytes:    C.BYTES.kib(64),
         errorClass:  ResolverError,
@@ -599,6 +648,8 @@ async function _wireLookup(name, qtype, timeoutMs) {
       _fail(new ResolverError("resolver/upstream-failed",
         "DoH request failed: " + e.message));
     });
+    // POST carries the wire-format query as the body; GET carried it in the URL.
+    if (usePost) req.write(qbuf);
     req.end();
   });
 }
@@ -709,7 +760,19 @@ async function safeResolveTxt(qname, opts) {
   try {
     return await resolveTxt(qname, opts.dnsLookup);
   } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
+    // `resolver/nxdomain` belongs here and was the omission: it is how THIS
+    // framework's own resolver reports a name that does not exist, which is the
+    // commonest way a policy record is absent. Only ENOTFOUND / ENODATA were
+    // listed — the codes node's stub resolver uses — so the documented
+    // "absence is not an error" convention held for an operator-supplied
+    // `dnsLookup` and not for the resolver the module ships with.
+    //
+    // `resolver/query-failed` deliberately does NOT belong here. A lookup that
+    // was not answered is not a record that is not published, and treating it
+    // as one lets an attacker who can break the query delete the policy that
+    // would have refused them.
+    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA" ||
+              e.code === "resolver/nxdomain")) return null;
     var msg = "TXT lookup for " + qname + " failed: " + ((e && e.message) || String(e));
     if (typeof opts.errorFactory === "function") throw opts.errorFactory(opts.code, msg);
     throw e;

package/lib/network-dns.js

@@ -437,6 +437,31 @@ function useDnsOverHttps(opts) {
   observability().safeEvent("network.dns.doh.set", 1, { url: url, method: method || "auto" });
 }
 
+// activeDohEndpoint() — where DoH queries go right now, or null when the
+// deployment is not on DoH (the operator chose DoT or the system resolver).
+//
+// b.network.dns.resolver runs its own wire-format request, because it needs the
+// raw response bytes for arbitrary record types and this module's DoH path
+// returns decoded addresses. Reading the endpoint from here is what keeps the
+// two agreeing: the resolver previously hardcoded a public provider, so a
+// deployment that had configured DoH to its own resolver — for split horizon,
+// for privacy, or because that resolver validates DNSSEC — had every
+// resolver.query() go to the public one instead, silently.
+// `getUrlMaxBytes` travels with it because the method is not always configured:
+// RFC 8484 §4.1 lets a client switch to POST when the GET URL would be too
+// long, and that threshold is this module's to choose. Returning it keeps the
+// resolver's decision identical to the one made here rather than a second
+// number that can drift.
+function activeDohEndpoint() {
+  if (!STATE.doh) return null;
+  return {
+    url:             STATE.doh.url,
+    method:          STATE.doh.method || null,
+    ca:              STATE.doh.ca || null,
+    getUrlMaxBytes:  DOH_GET_URL_MAX_BYTES,
+  };
+}
+
 function useDnsOverTls(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "servername", "ca"], "dns.useDnsOverTls");
@@ -2259,6 +2284,7 @@ module.exports = {
   setLookupTimeoutMs:          setLookupTimeoutMs,
   setCacheTtlMs:               setCacheTtlMs,
   useDnsOverHttps:             useDnsOverHttps,
+  activeDohEndpoint:           activeDohEndpoint,
   useDnsOverTls:               useDnsOverTls,
   useSystemResolver:           useSystemResolver,
   useDesignatedResolvers:      useDesignatedResolvers,

package/lib/network-smtp-policy.js

@@ -243,17 +243,49 @@ async function daneTlsa(domain, port, opts) {
   opts = opts || {};
   var p = typeof port === "number" ? port : 25;                                  // IANA SMTP port
   var qname = "_" + p + "._tcp." + domain.toLowerCase();
-  // node:dns has resolveTlsa() since Node 18.16.0.
-  if (typeof dnsPromises.resolveTlsa !== "function") {
-    throw new SmtpPolicyError("smtp/dane-unavailable",
-      "node:dns.resolveTlsa is not available on this runtime");
-  }
+
+  // `opts.resolver` is the caller's own resolver — the one whose DNSSEC posture
+  // `opts.dnssecValidated` is an assertion ABOUT. Falling back to node:dns here
+  // when one was supplied would mean the assertion described resolver A while
+  // the records arrived from resolver B, so a non-validating system resolver
+  // could hand over spoofed TLSA data that DANE then treats as authenticated.
+  // A supplied resolver that cannot answer TLSA is refused rather than bypassed.
   var records;
-  try { records = await dnsPromises.resolveTlsa(qname); }
-  catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return [];
-    throw new SmtpPolicyError("smtp/dane-lookup-failed",
-      "TLSA lookup for " + qname + " failed: " + ((e && e.message) || String(e)));
+  if (opts.resolver) {
+    if (typeof opts.resolver.queryTlsa !== "function") {
+      throw new SmtpPolicyError("smtp/dane-resolver-no-tlsa",
+        "dane.tlsa: opts.resolver was supplied but has no queryTlsa(name); the " +
+        "records must come from the resolver whose DNSSEC posture was asserted, " +
+        "so falling back to the system resolver is refused");
+    }
+    var rv;
+    try { rv = await opts.resolver.queryTlsa(qname); }
+    catch (e0) {
+      if (e0 && e0.code === "resolver/nxdomain") return [];                      // no TLSA published
+      throw new SmtpPolicyError("smtp/dane-lookup-failed",
+        "TLSA lookup for " + qname + " failed: " + ((e0 && e0.message) || String(e0)));
+    }
+    // b.network.dns decodes TLSA into { usage, selector, matchingType, certData };
+    // node:dns names the same fields certUsage / selector / match / data. Mapped
+    // here so the normalisation below has one shape to read.
+    records = ((rv && rv.rrs) || []).filter(function (r) {
+      return r && r.decoded && typeof r.decoded.usage === "number";
+    }).map(function (r) {
+      return { certUsage: r.decoded.usage, selector: r.decoded.selector,
+               match: r.decoded.matchingType, data: r.decoded.certData };
+    });
+  } else {
+    // node:dns has resolveTlsa() since Node 18.16.0.
+    if (typeof dnsPromises.resolveTlsa !== "function") {
+      throw new SmtpPolicyError("smtp/dane-unavailable",
+        "node:dns.resolveTlsa is not available on this runtime");
+    }
+    try { records = await dnsPromises.resolveTlsa(qname); }
+    catch (e) {
+      if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return [];
+      throw new SmtpPolicyError("smtp/dane-lookup-failed",
+        "TLSA lookup for " + qname + " failed: " + ((e && e.message) || String(e)));
+    }
   }
   // RFC 7672 §1.3 — TLSA records that are NOT DNSSEC-validated MUST
   // NOT be used. node:dns.resolveTlsa does not surface the AD bit

package/lib/parsers/safe-yaml.js

@@ -60,6 +60,7 @@ var boundedMap = require("../bounded-map");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var codepointClass = require("../codepoint-class");
+var yamlLex = require("../yaml-lex");
 var { FrameworkError } = require("../framework-error");
 
 class SafeYamlError extends FrameworkError {
@@ -227,7 +228,10 @@ function _findAnchorOrAlias(text) {
     var ch = text.charAt(i);
     if (ch !== "&" && ch !== "*") continue;
     var atStart = i === 0;
-    if (!atStart && !_isWhitespaceChar(text.charAt(i - 1))) continue;
+    // No test on the preceding character: `text` is the shared mask, in which a
+    // sigil survives only where it opens a node. The whitespace test was the
+    // original defect and it also had no way to admit `{"a":&anchor v}`, where
+    // a quoted key takes its colon with no space after it.
     if (_NAME_HEAD.indexOf(text.charAt(i + 1)) === -1 || text.charAt(i + 1) === "") continue;
     return { index: atStart ? i : i - 1, sigil: ch };
   }
@@ -239,8 +243,10 @@ function _findTag(text) {
   for (var i = 0; i < text.length; i += 1) {
     if (text.charAt(i) !== "!") continue;
     var atStart = i === 0;
-    var before = text.charAt(i - 1);
-    if (!atStart && !(before === "-" || _isWhitespaceChar(before))) continue;
+    // Same as above: position is the mask's judgement. Requiring whitespace or
+    // a dash before the tag let `{"a":!!python/object x}` through, because the
+    // character in front of it is the colon of a JSON-style key — and a
+    // deserialization tag is the one thing this ban exists for.
     // The pattern is greedy, so it takes two `!` when both are present.
     var after = text.charAt(i + 1) === "!" ? text.charAt(i + 2) : text.charAt(i + 1);
     if (after.length !== 1) continue;
@@ -1194,6 +1200,21 @@ function _preValidate(input) {
     advance();
   }
 
+  // The masking above is kept for ONE thing: it is the scan that notices an
+  // unterminated quote, and that diagnosis is this parser's to give. What it
+  // produced was not a usable screen. Its own header promised that block-scalar
+  // bodies were masked and there was no block-scalar handling in it at all, and
+  // comment text was copied through verbatim under a comment saying so — which
+  // is why `x: 1 # note !bang` and `x: |` / `  echo !boom` were both refused as
+  // tags. A plain scalar was not understood either, so `x: hello !world` was
+  // refused for a bang sitting in the middle of a value.
+  //
+  // The banned-construct scan therefore runs against the shared lexer's mask.
+  // `guard-yaml` had the same three gaps in a separate implementation, and one
+  // scan answering "which region is this character in" is what stops the two
+  // drifting apart again.
+  safe = yamlLex.maskNonStructural(input);
+
   // Now scan `safe` for banned constructs.
   // Banned tokens (must be at line-start or after whitespace, not in keys):
   //   &name      anchor

package/lib/redact.js

@@ -527,8 +527,14 @@ function classifyDefaults(opts) {
         "redact.classifyDefaults: patterns[" + p + "] must be a string, got " +
         typeof patterns[p]);
     }
+    // Own-key on BOTH tables. `extra` is operator-supplied, so reading it
+    // plainly resolved "constructor" / "toString" / "valueOf" to inherited
+    // functions: the name passed as known, and the scanner then met a function
+    // where a pattern spec belongs and threw an untyped error at scan time.
+    // A DLP classifier must fail at boot on a name it cannot honour, never at
+    // the moment it is asked to look.
     if (!Object.prototype.hasOwnProperty.call(CLASSIFIER_PATTERNS, patterns[p]) &&
-        !(opts.extra && opts.extra[patterns[p]])) {
+        !(opts.extra && Object.prototype.hasOwnProperty.call(opts.extra, patterns[p]))) {
       throw new DlpError("redact-dlp/unknown-pattern",
         "redact.classifyDefaults: unknown pattern '" + patterns[p] +
         "'. Known: " + Object.keys(CLASSIFIER_PATTERNS).join(", "));
@@ -544,8 +550,12 @@ function classifyDefaults(opts) {
   var extra = opts.extra || {};
 
   function _resolve(name) {
-    var spec = CLASSIFIER_PATTERNS[name] || extra[name];
-    return spec;
+    // Own-key, matching the validation above: the names reaching here are
+    // already vetted, and reading through the prototype anyway would let a
+    // future caller that skips the vetting resolve a function as a spec.
+    if (Object.prototype.hasOwnProperty.call(CLASSIFIER_PATTERNS, name)) return CLASSIFIER_PATTERNS[name];
+    if (Object.prototype.hasOwnProperty.call(extra, name)) return extra[name];
+    return undefined;
   }
 
   return function classify(input) {

package/lib/retention.js

@@ -55,6 +55,9 @@ var { defineClass } = require("./framework-error");
 var audit = lazyRequire(function () { return require("./audit"); });
 var cryptoField = require("./crypto-field");
 var legalHold = lazyRequire(function () { return require("./legal-hold"); });
+// Lazy — compliance.js requires this module for its posture cascade, so the
+// dependency is mutual and neither may load the other at module scope.
+var compliance = lazyRequire(function () { return require("./compliance"); });
 
 var RetentionError = defineClass("RetentionError", { alwaysPermanent: true });
 var _err = RetentionError.factory;
@@ -648,10 +651,27 @@ function complianceFloor(posture, candidateTtlMs) {
   var floor = Object.prototype.hasOwnProperty.call(COMPLIANCE_RETENTION_FLOOR_MS, posture)
     ? COMPLIANCE_RETENTION_FLOOR_MS[posture] : undefined;
   if (floor === undefined) {
+    // "This regime sets no retention minimum" and "this is not a regime" are
+    // different facts, and the floor table only ever answered the first. Most
+    // postures the framework knows impose no minimum — GDPR Art. 5(1)(e) is
+    // storage LIMITATION, the opposite of a floor — so treating absence from
+    // this table as a typo reported 158 of the 169 postures b.compliance.set
+    // accepts as misspellings, and an operator who set one could not compute a
+    // TTL at all. The posture vocabulary lives in b.compliance; this table
+    // holds only the subset carrying a regulator-mandated minimum.
+    if (compliance().KNOWN_POSTURES.indexOf(posture) !== -1) return _atLeast(0, candidateTtlMs);
     throw new RetentionError("retention/unknown-posture",
-      "complianceFloor: unknown posture '" + posture + "'; expected one of " +
-      Object.keys(COMPLIANCE_RETENTION_FLOOR_MS).join(", "));
+      "complianceFloor: unknown posture '" + posture + "'; it is not in " +
+      "b.compliance.KNOWN_POSTURES. Postures carrying a retention minimum are " +
+      Object.keys(COMPLIANCE_RETENTION_FLOOR_MS).join(", ") + "; the rest resolve to 0");
   }
+  return _atLeast(floor, candidateTtlMs);
+}
+
+// The floor wins unless the operator's candidate is longer. A candidate that
+// is absent or not a positive finite number is no candidate at all, and the
+// floor stands alone.
+function _atLeast(floor, candidateTtlMs) {
   if (typeof candidateTtlMs !== "number" || !isFinite(candidateTtlMs) || candidateTtlMs <= 0) {
     return floor;
   }

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-23T07:32:38.917Z"
+      "refreshedAt": "2026-08-24T23:54:10.282Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-23T07:32:38.917Z"
+      "refreshedAt": "2026-08-24T23:54:10.282Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-23T07:32:38.917Z",
+      "refreshedAt": "2026-08-24T23:54:10.282Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-23T07:32:38.917Z",
+      "refreshedAt": "2026-08-24T23:54:10.282Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-23T07:32:38.917Z"
+      "refreshedAt": "2026-08-24T23:54:10.282Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-23T07:32:38.917Z"
+      "refreshedAt": "2026-08-24T23:54:10.282Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-23T07:32:38.917Z"
+      "refreshedAt": "2026-08-24T23:54:10.282Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.28",
+      "version": "0.5.30",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -216,12 +216,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-23T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.28:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-24T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.30:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:a11e84272034dc4065dac44f55b722b3b4e1803ddeb27b09cbe6d8644225209c"
+        "server": "sha256:fc8b1783ae40c377c1bc7afb7bd902b5282c165ed11354b803867f7d9f75f021"
       },
-      "refreshedAt": "2026-08-23T07:32:38.917Z"
+      "refreshedAt": "2026-08-24T23:54:10.282Z"
     }
   }
 }