@blamejs/core 0.7.19 → 0.7.20

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.20** (2026-05-05) — browser-hardening batch (5 fixes): CSRF Origin/Referer cross-check, default CSP gains Trusted Types, expanded Permissions-Policy, `__Host-` / `__Secure-` cookie prefix invariants, `b.middleware.fetchMetadata`. **CSRF Origin/Referer cross-check** (`b.middleware.csrfProtect`) — second-line defense alongside the double-submit token. State-changing requests whose Origin (or Referer when Origin is absent) doesn't resolve to the request's own origin are refused before the token check. Defaults ON; operator opt-out via `checkOrigin: false`; operator allowlist via `allowedOrigins: ["https://app.example.com"]`. Missing-Origin-AND-Missing-Referer (curl, server-to-server) defers to the token check. **Trusted Types in default CSP** (`b.middleware.securityHeaders`) — default CSP now includes `require-trusted-types-for 'script'; trusted-types 'allow-duplicates' default;`. Compatible browsers (Chrome 83+, Edge 83+) enforce typed-value DOM-sink writes (defends every untrusted-string-to-DOM XSS vector at runtime); Firefox + Safari ignore (no regression). Operators opt out by passing an explicit `csp:` value. **Expanded Permissions-Policy** — defaults now disable `browsing-topics=()`, `attribution-reporting=()`, `unload=()`, `interest-cohort=()`, `join-ad-interest-group=()`, `run-ad-auction=()`, `private-state-token-issuance=()`, `private-state-token-redemption=()`, `compute-pressure=()`, `hid=()`, `serial=()`, `idle-detection=()` — closes advertising / tracking / load-event-leak / device-API surfaces. Existing operator overrides via `permissionsPolicy: "..."` continue unchanged. **`__Host-` / `__Secure-` cookie prefix invariants** (`b.cookies.serialize`) — RFC 6265bis §4.1.3 enforced at serialize time. `__Secure-*` requires `secure: true`; `__Host-*` requires `secure: true` AND `path: "/"` AND no `domain:`. Each violation throws a typed `CookieError` with operator-actionable code (`cookies/prefix-secure-required`, `cookies/prefix-host-secure-required`, `cookies/prefix-host-path-required`, `cookies/prefix-host-no-domain`) instead of producing a malformed cookie that browsers silently reject. **`b.middleware.fetchMetadata`** — new fetch-metadata isolation primitive. Reads `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` and refuses cross-site state-changing requests by default. Operators opt in to specific destinations (e.g. `allowedDest: ["empty", "document"]`) or specific origins (`allowCrossSite: true`). Direct navigations (typed URL / bookmark — `Sec-Fetch-Site: none`) pass through; `same-origin` always passes; `same-site` configurable. Missing fetch-metadata (legacy browsers, server-to-server) deferred to other auth/CSRF layers per `allowMissing: true` default. Smoke 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.19** (2026-05-05) — auth-primitives batch (5 fixes): session idle/absolute timeout, JWT keyResolver for kid rotation, `b.middleware.bearerAuth`, `b.auth.jwt.verifyExternal` (classical-alg JWT verifier with JWKS support), and Argon2id parameter audit visibility. **Session idle + absolute timeouts** (`b.session.verify`) now enforce OWASP ASVS 5.0 §3.3 / NIST SP 800-63B-4 — defaults: 30 min idle, 12 hours absolute. Operators opt out per-call by passing `idleTimeoutMs: 0` / `absoluteTimeoutMs: 0`. Both surface `auth.session.expired_idle` / `auth.session.expired_absolute` audit events on enforcement. **JWT `keyResolver` opt** (`b.auth.jwt.verify`) — operator passes `keyResolver(decodedHeader)` to look up the public key per-token (typically by `kid`). Mutually exclusive with `opts.publicKey`. Async-friendly. Closes the kid-rotation gap where signers carried `kid` but verifiers only accepted a single static key. **`b.middleware.bearerAuth`** — new middleware that extracts `Authorization: Bearer <token>`, runs an operator-supplied `verify(token)` function, and attaches `req.user`. Distinct from cookie-session `attachUser`. Missing-Authorization passes through (so cookie path can take over); invalid/null/throw rejects 401 + `WWW-Authenticate: Bearer error="invalid_token"` per RFC 6750 §3. **`b.auth.jwt.verifyExternal`** — new generic classical-alg JWT verifier (RS256 / RS384 / RS512 / PS256 / PS384 / PS512 / ES256 / ES384 / ES512 / EdDSA) for integration with external IdPs (Auth0 / Okta / Keycloak / Cognito / Azure AD / Google / Apple). `algorithms` is REQUIRED with no default — defends the alg-confusion class (CVE-2024-54150 / CVE-2025-30144 / CVE-2026-22817 Hono). HMAC algs and `none` are explicitly refused (HMAC + JWKS public-key trust source IS the alg-confusion vector). Three key-source options: `jwks` (pre-fetched array), `jwksUri` (auto-fetched + TTL-cached via `b.httpClient` SSRF gate), `keyResolver` (custom). Standard claim checks (`exp` / `nbf` / `iat` / `aud` / `iss` / `sub`) with operator-tunable `clockSkewMs`. **`b.auth.password.params()`** — new accessor returning the active Argon2id params (`memoryCostKib` / `timeCost` / `parallelism`) plus the OWASP 2026 floor (`19 MiB` / `t>=2` / `p>=1`) plus `meetsFloor: bool`. Compliance-audit visibility without parsing PHC strings. Smoke 8458 → 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.18** (2026-05-05) — transport-layer smuggling hardening (four ship-blocker fixes). **HTTP request-smuggling defense** in `b.middleware.bodyParser` per RFC 9112 §6.1: rejects requests with both `Content-Length` and `Transfer-Encoding` headers (CL.TE / TE.CL smuggling — CVE-2022-31394 / CVE-2024-27316 class), multiple `Content-Length` values, `Transfer-Encoding` whose final coding is not `chunked`, and duplicate `chunked` tokens (TE.TE smuggling). Each rejection responds 400 + `Connection: close` so the upstream proxy doesn't reuse the socket. **Static-serve symlink-escape + filename safety** in `b.staticServe`: `_resolveSafe` now `fs.realpathSync`-es the resolved path (defeats symlink-out-of-root) AND validates the basename through `b.guardFilename` at the balanced profile (rejects path traversal, null-byte, NTFS alternate data streams, UNC paths, RTLO bidi, overlong UTF-8, Windows reserved device names, double-extension; balanced profile chosen over strict so legitimate operator-deposited shell-exec extensions like `.exe`/`.bin` remain serveable). **Outbound SMTP smuggling defense** in `b.mail` SMTP transport: every produced RFC 822 wire (post-DKIM-sign) is run through `b.guardEmail.validateMessage` at strict profile before the socket opens; refuses on critical issues — bare CR / bare LF + smuggled SMTP verbs (CVE-2023-51764 Postfix / CVE-2023-51765 Sendmail / CVE-2023-51766 Exim / CVE-2026-32178 .NET class) cannot leave the framework even when operator-supplied subject/body/headers contain the pattern. **DKIM `l=` body-length tag forbidden** in `b.mail.dkim.create`: passing `bodyLength` now throws `dkim/l-tag-forbidden` at create-time. M³AAWG / Gmail / Microsoft 365 guidance is "never use l=" — it enables append-after-signature attacks where an attacker appends arbitrary content past the signed length and the DKIM signature still validates against the original prefix. The body is always hashed in full. Smoke 8450 → 8458 / wiki e2e 178 / Linux container smoke 8458 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/lib/cookies.js

@@ -144,6 +144,41 @@ function serialize(name, value, attrs) {
   _validateValue(value);
   attrs = attrs || {};
 
+  // RFC 6265bis §4.1.3 cookie-prefix invariants — refused at serialize-
+  // time so an operator-side typo doesn't ship a broken cookie that
+  // browsers silently reject (and the operator wonders why their cookie
+  // never sets).
+  //
+  //   __Secure-* — MUST be Secure
+  //   __Host-*   — MUST be Secure, Path=/, NO Domain
+  //
+  // Caught at the source so every caller (csrf-protect / session /
+  // operator) gets the same enforcement.
+  if (name.indexOf("__Secure-") === 0) {
+    if (attrs.secure !== true) {
+      throw new CookieError("cookies/prefix-secure-required",
+        "__Secure-* cookies MUST set Secure (RFC 6265bis §4.1.3.1) — got '" +
+        name + "' without secure: true");
+    }
+  }
+  if (name.indexOf("__Host-") === 0) {
+    if (attrs.secure !== true) {
+      throw new CookieError("cookies/prefix-host-secure-required",
+        "__Host-* cookies MUST set Secure (RFC 6265bis §4.1.3.2) — got '" +
+        name + "' without secure: true");
+    }
+    if (attrs.path !== "/") {
+      throw new CookieError("cookies/prefix-host-path-required",
+        "__Host-* cookies MUST set Path=/ (RFC 6265bis §4.1.3.2) — got '" +
+        name + "' with path=" + JSON.stringify(attrs.path || "<unset>"));
+    }
+    if (attrs.domain) {
+      throw new CookieError("cookies/prefix-host-no-domain",
+        "__Host-* cookies MUST NOT set Domain (RFC 6265bis §4.1.3.2) — got '" +
+        name + "' with domain=" + JSON.stringify(attrs.domain));
+    }
+  }
+
   var parts = [name + "=" + encodeURIComponent(value)];
 
   if (attrs.maxAge !== undefined && attrs.maxAge !== null) {

package/lib/middleware/csrf-protect.js

@@ -155,6 +155,63 @@ function _appendSetCookie(res, value) {
 // owns size caps, content-type dispatch, and prototype-pollution
 // defense; csrf-protect just reads the validated value.
 
+// Origin / Referer cross-check helper. Returns null when the request's
+// origin is acceptable, or a short reason string ("origin-mismatch" /
+// "referer-mismatch" / "no-origin-or-referer" / "malformed-url") when
+// it should be refused. Compares against opts.allowedOrigins (when
+// supplied) OR same-origin (the request's own Host header).
+//
+// Implementation note — we deliberately don't run safeUrl here; safeUrl
+// throws on file:// / data:// schemes which would crash the middleware
+// instead of refusing the request. URL constructor + try/catch is the
+// right shape for "is this URL well-formed and what's its origin?".
+function _checkOriginAllowed(req, allowedOrigins, isHttpsFn) {
+  var headers = req.headers || {};
+  var origin = headers.origin;
+  var referer = headers.referer;
+  if (typeof origin !== "string" && typeof referer !== "string") {
+    // No Origin/Referer at all — common for non-browser clients
+    // (curl, server-to-server). The token check still applies; this
+    // gate doesn't add to it. Defense-in-depth against a stolen
+    // cookie via a browser-rendered cross-origin fetch IS the value;
+    // headless clients carry their own auth threat model.
+    return null;
+  }
+
+  var requestOrigin = (isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
+                      (headers.host || "");
+
+  function _originOf(rawUrl) {
+    try {
+      var u = new URL(rawUrl);                                                   // allow:raw-new-url — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
+      return u.origin;                                                           // "https://host:port" — no path / query / fragment
+    } catch (_e) { return null; }
+  }
+
+  function _isAllowed(candidateOrigin) {
+    if (!candidateOrigin) return false;
+    if (candidateOrigin === requestOrigin) return true;
+    if (Array.isArray(allowedOrigins)) {
+      for (var i = 0; i < allowedOrigins.length; i += 1) {
+        if (candidateOrigin === allowedOrigins[i]) return true;
+      }
+    }
+    return false;
+  }
+
+  if (typeof origin === "string" && origin.length > 0) {
+    var oo = _originOf(origin);
+    if (oo === null) return "malformed-origin";
+    if (!_isAllowed(oo)) return "origin-mismatch (" + oo + " vs " + requestOrigin + ")";
+    return null;
+  }
+  // Origin absent — fall back to Referer.
+  var ro = _originOf(referer);
+  if (ro === null) return "malformed-referer";
+  if (!_isAllowed(ro)) return "referer-mismatch (" + ro + " vs " + requestOrigin + ")";
+  return null;
+}
+
 function _writeReject(res, message) {
   if (typeof res.writeHead === "function") {
     var body = JSON.stringify({ error: message });
@@ -171,7 +228,7 @@ function create(opts) {
 
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
-    "trustProxy",
+    "trustProxy", "checkOrigin", "allowedOrigins",
   ], "middleware.csrfProtect");
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;
@@ -193,6 +250,20 @@ function create(opts) {
   var methods    = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn    = opts.audit !== false;
 
+  // Origin / Referer cross-check — second-line defense alongside the
+  // double-submit token. If the request's Origin (or Referer when
+  // Origin is absent — Safari pre-12, certain CORS mode requests)
+  // doesn't resolve to a same-origin or operator-allowlisted origin,
+  // refuse before the token check.
+  //
+  // Default: enabled (defense-in-depth — same shape as bot-guard /
+  // rate-limit / CSP nonce — every default ON per Core Rule §3).
+  // Operator opt-out: opts.checkOrigin = false.
+  // Operator allowlist: opts.allowedOrigins = ["https://app.example.com"].
+  var checkOrigin = opts.checkOrigin !== false;
+  var allowedOrigins = Array.isArray(opts.allowedOrigins)
+    ? opts.allowedOrigins.slice() : null;
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -282,6 +353,18 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
+    // Origin / Referer cross-check (defense-in-depth alongside the
+    // double-submit token). Refuses cross-origin state-changing
+    // requests even when the token is valid (e.g. operator-mistaken
+    // CORS configuration that exposes the cookie).
+    if (checkOrigin) {
+      var originReason = _checkOriginAllowed(req, allowedOrigins, _isHttps);
+      if (originReason !== null) {
+        _emitDenied(req, "origin/referer: " + originReason);
+        return _writeReject(res, "CSRF cross-origin request refused.");
+      }
+    }
+
     if (!cookieCfg) {
       // Session-stored mode — operator's tokenLookup is the source.
       expected = opts.tokenLookup(req);

package/lib/middleware/fetch-metadata.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * fetch-metadata — Sec-Fetch-Site / Sec-Fetch-Mode / Sec-Fetch-Dest
+ * isolation primitive (Resource Isolation Policy / Site Isolation —
+ * https://web.dev/fetch-metadata/).
+ *
+ * Browsers attach Sec-Fetch-* headers describing the FETCH context
+ * (same-site? cross-site? typed-URL? navigation? script load?).
+ * This middleware refuses cross-site requests on state-changing
+ * methods unless the operator explicitly allowlists them — a second-
+ * line defense alongside CSRF tokens.
+ *
+ *   var fmGate = b.middleware.fetchMetadata({
+ *     allowSameSite:    true,           // default
+ *     allowCrossSite:   false,          // default — refuse cross-site state changes
+ *     allowedDest:      ["empty", "document"],   // operator allowlist of Sec-Fetch-Dest
+ *     allowedNavigate:  true,           // allow direct navigations (typed URL / bookmark)
+ *     methods:          ["POST","PUT","DELETE","PATCH"],
+ *     audit:            true,
+ *   });
+ *   router.use("/api", fmGate);
+ *
+ * Refusal shape: 403 application/json + audit row. Same-origin /
+ * same-site requests pass through; cross-site refused unless
+ * allowedDest contains the request's Sec-Fetch-Dest. None / undefined
+ * (legacy browsers without fetch-metadata) is treated per
+ * `allowMissing` (default true — don't break older clients).
+ *
+ * Fail-open posture: when the request is missing Sec-Fetch-* entirely
+ * (curl, server-to-server, browser <Chrome 76 / <Firefox 90 / <Safari
+ * 16.4), the gate defers to other auth/CSRF layers. The browser-fetch-
+ * metadata isolation IS the value-add; non-browser clients carry their
+ * own auth threat model.
+ */
+
+var requestHelpers = require("../request-helpers");
+var validateOpts = require("../validate-opts");
+var lazyRequire = require("../lazy-require");
+
+var audit = lazyRequire(function () { return require("../audit"); });
+var observability = lazyRequire(function () { return require("../observability"); });
+
+var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+
+function _writeReject(res, message) {
+  if (res.headersSent) return;
+  var body = JSON.stringify({ error: message });
+  res.writeHead(requestHelpers.HTTP_STATUS.FORBIDDEN, {
+    "Content-Type":   "application/json; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body),
+  });
+  res.end(body);
+}
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "allowSameSite", "allowCrossSite", "allowMissing",
+    "allowedDest", "allowedNavigate", "methods", "audit",
+  ], "middleware.fetchMetadata");
+
+  var allowSameSite   = opts.allowSameSite !== false;
+  var allowCrossSite  = opts.allowCrossSite === true;
+  var allowMissing    = opts.allowMissing !== false;
+  var allowedDest     = Array.isArray(opts.allowedDest)    ? opts.allowedDest.slice()    : null;
+  var allowedNavigate = opts.allowedNavigate !== false;
+  var methods         = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
+  var auditOn         = opts.audit !== false;
+
+  function _emitDenied(req, reason) {
+    if (!auditOn) return;
+    try {
+      audit().safeEmit({
+        action:   "auth.fetch_metadata.denied",
+        outcome:  "denied",
+        actor:    requestHelpers.extractActorContext(req),
+        reason:   reason,
+        metadata: { method: req.method, path: (req.url || "").split("?")[0] },
+      });
+    } catch (_e) { /* audit best-effort */ }
+  }
+
+  return function fetchMetadata(req, res, next) {
+    if (methods.indexOf(req.method) === -1) return next();
+
+    var headers = req.headers || {};
+    var site = headers["sec-fetch-site"];
+    var mode = headers["sec-fetch-mode"];
+    var dest = headers["sec-fetch-dest"];
+
+    if (typeof site !== "string" || site.length === 0) {
+      // No Sec-Fetch-Site header — legacy browser or non-browser client.
+      // Defer to other auth/CSRF layers per allowMissing.
+      if (!allowMissing) {
+        _emitDenied(req, "fetch-metadata-missing");
+        return _writeReject(res, "Fetch-metadata required.");
+      }
+      return next();
+    }
+
+    // Direct navigations — typed URL, bookmark, history navigation.
+    if (site === "none") {
+      if (allowedNavigate) return next();
+      _emitDenied(req, "navigate-disallowed");
+      return _writeReject(res, "Direct navigation not allowed for this method.");
+    }
+
+    if (site === "same-origin") return next();
+
+    if (site === "same-site") {
+      if (allowSameSite) return next();
+      _emitDenied(req, "same-site-disallowed");
+      return _writeReject(res, "Same-site request not allowed.");
+    }
+
+    // cross-site
+    if (allowCrossSite) return next();
+    if (allowedDest && typeof dest === "string" && allowedDest.indexOf(dest) !== -1) {
+      return next();
+    }
+    _emitDenied(req, "cross-site-refused (mode=" + (mode || "?") +
+                     ", dest=" + (dest || "?") + ")");
+    try { observability().count("auth.fetch_metadata.cross_site_refused", 1, {}); }
+    catch (_e) { /* best-effort */ }
+    return _writeReject(res, "Cross-site request refused.");
+  };
+}
+
+module.exports = { create: create };

package/lib/middleware/index.js

@@ -27,6 +27,7 @@ var cspNonce = require("./csp-nonce");
 var csrfProtect = require("./csrf-protect");
 var dbRoleFor = require("./db-role-for");
 var errorHandler = require("./error-handler");
+var fetchMetadata = require("./fetch-metadata");
 var health = require("./health");
 var networkAllowlist = require("./network-allowlist");
 var rateLimit = require("./rate-limit");
@@ -47,6 +48,7 @@ module.exports = {
   bearerAuth:       bearerAuth.create,
   requireAuth:      requireAuth.create,
   csrfProtect:      csrfProtect.create,
+  fetchMetadata:    fetchMetadata.create,
   bodyParser:       bodyParser.create,
   health:           health.create,
   compression:      compression.create,
@@ -69,6 +71,7 @@ module.exports = {
     bearerAuth:       bearerAuth,
     requireAuth:      requireAuth,
     csrfProtect:      csrfProtect,
+    fetchMetadata:    fetchMetadata,
     bodyParser:       bodyParser,
     health:           health,
     compression:      compression,

package/lib/middleware/security-headers.js

@@ -46,12 +46,15 @@ var DEFAULT_PERMISSIONS = [
   "screen-wake-lock=()", "sync-xhr=()", "usb=()", "web-share=()", "xr-spatial-tracking=()",
 ];
 
-// Strict CSP — no 'unsafe-inline' on script-src OR style-src. Operators
-// with inline styles / scripts wire `b.middleware.cspNonce()` and use
-// `{{ cspNonce }}` in their views (or req.cspNonce in handlers); the
-// nonce hooks into the policy via the `csp` opt or a custom value.
-// Operators in transitional environments who genuinely need inline
-// styles set `csp` explicitly to the loose form.
+// Strict CSP — no 'unsafe-inline' on script-src OR style-src.
+// Trusted Types (require-trusted-types-for 'script') enables the
+// browser's strongest XSS-mitigation primitive — DOM-sink writes via
+// innerHTML / outerHTML / setHTML require typed values, surfacing
+// every untrusted-string-to-DOM path at runtime so operators can audit
+// + fix them. Compatible browsers (Chrome 83+, Edge 83+) enforce;
+// Firefox + Safari ignore (no regression). Operators with inline
+// scripts wire `b.middleware.cspNonce()` and use `{{ cspNonce }}` in
+// views.
 var DEFAULT_CSP =
   "default-src 'self'; " +
   "script-src 'self'; " +
@@ -62,7 +65,9 @@ var DEFAULT_CSP =
   "frame-ancestors 'none'; " +
   "base-uri 'self'; " +
   "form-action 'self'; " +
-  "object-src 'none';";
+  "object-src 'none'; " +
+  "require-trusted-types-for 'script'; " +
+  "trusted-types 'allow-duplicates' default;";
 
 function create(opts) {
   opts = opts || {};

package/lib/static.js

@@ -168,19 +168,21 @@ function _resolveSafe(root, requestedPath) {
 
   // Symlink-escape defense — the lexical resolve above only sees the
   // requested path tokens; a symlink anywhere along `resolved` can
-  // still point outside `rootResolved` on disk. realpath every node
-  // (only when it exists; missing files are routed through the
-  // standard 404 path by the caller).
+  // still point outside `rootResolved` on disk. Compare via realpath
+  // for the escape check ONLY; do NOT substitute the realpath result
+  // for `resolved`. Substituting breaks downstream consumers that key
+  // on the lexical path (revoke list, ETag cache, audit row) AND
+  // breaks deploys where the OS prefix-symlinks the temp dir
+  // (macOS: /var/folders/X/Y → /private/var/folders/X/Y).
   try {
     var real = fs.realpathSync(resolved);
     var rootReal = fs.realpathSync(rootResolved);
     if (real !== rootReal && !real.startsWith(rootReal + path.sep)) return null;
-    resolved = real;
   } catch (_e) {
     // Path doesn't exist (or is denied) — fall through with the lexical
     // resolution so the caller's stat() returns the natural ENOENT and
     // 404s. realpath failures from non-existence are NOT a smuggling
-    // signal.
+    // signal; the lexical bound check above already rejected escapes.
   }
 
   // Filename safety — the basename gates against path-traversal /

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.19",
+  "version": "0.7.20",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3cf8a44f-f452-436c-a92e-cc1ae392a5e5",
+  "serialNumber": "urn:uuid:be5934ef-c4b9-4516-a8ee-b8bb2c31ee26",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T05:30:46.323Z",
+    "timestamp": "2026-05-05T05:52:29.844Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.19",
+      "bom-ref": "@blamejs/core@0.7.20",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.19",
+      "version": "0.7.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.19",
+      "purl": "pkg:npm/%40blamejs/core@0.7.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.19",
+      "ref": "@blamejs/core@0.7.20",
       "dependsOn": []
     }
   ]