@blamejs/core 0.7.20 → 0.7.21

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.21** (2026-05-05) — small primitive batch (5 fixes): TLS 1.3 framework-wide minimum, `b.safeRedirect`, `b.pick`, audit-sign legacy compat-shim removed, webhook PQC signatures emit base64url. **Framework-wide TLS 1.3 minimum** — `index.js` sets `tls.DEFAULT_MIN_VERSION = "TLSv1.3"` once at boot, before any framework module loads `node:tls`. Applies to every TLS socket (outbound `https.request` / mail SMTP+STARTTLS / Redis-Postgres-Mongo TLS / `b.httpClient`, AND inbound `https.createServer` when blamejs is the listener). Per-call override still works for legacy peers. **`b.safeRedirect`** — open-redirect (CWE-601) defense. `b.safeRedirect.resolve(rawTarget, { allowedOrigins, allowedHosts, fallback })` returns the safe URL (or fallback). Refuses protocol-relative (`//attacker.com`), backslash variants (`\\\\attacker.com`), control-char-laden (CRLF header injection), and `data:` / `javascript:` schemes; same-origin paths (`/dashboard`) and fragments (`#x`) pass through; full URLs require explicit allowlist. Operator drops the result straight into `res.writeHead(302, { Location: ... })`. **`b.pick`** — mass-assignment (CWE-915 / OWASP API3:2023) defense. `b.pick(req.body, ["a", "b", ["nested", ["sub1"]]])` returns a NEW object with only allowlisted keys; prototype-pollution keys (`__proto__` / `constructor` / `prototype`) ALWAYS stripped even if listed. `opts.onUnknown: "throw"` rejects unknown keys instead of silently dropping. Nested allowlist syntax for object-shaped fields. **Audit-sign legacy compat-shim removed** — `lib/audit-sign.js` no longer falls back to `ml-dsa-87` for key files missing the `algorithm` field. Throws `KEY_FILE_MISSING_ALG` / `UNWRAPPED_MISSING_ALG` at load time; operators with legacy files rotate the key (deletes + regenerates) or hand-edit to add `"algorithm": "slh-dsa-shake-256f"`. Pre-v1 compat-shim sweep per the no-pre-v1-compat rule. **Webhook PQC signatures emit base64url** — `b.webhook` now signs to base64url (was hex). SLH-DSA-SHAKE-256f signatures are ~29.5 KB binary → ~40 KB base64url vs ~59 KB hex; the hex form blew past nginx default 8 KB / Cloudflare default 16 KB / many CDN edge limits. Verification accepts EITHER encoding for a transition window — base64url-shaped sig values decode as base64url; hex-shaped values decode as hex. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.20** (2026-05-05) — browser-hardening batch (5 fixes): CSRF Origin/Referer cross-check, default CSP gains Trusted Types, expanded Permissions-Policy, `__Host-` / `__Secure-` cookie prefix invariants, `b.middleware.fetchMetadata`. **CSRF Origin/Referer cross-check** (`b.middleware.csrfProtect`) — second-line defense alongside the double-submit token. State-changing requests whose Origin (or Referer when Origin is absent) doesn't resolve to the request's own origin are refused before the token check. Defaults ON; operator opt-out via `checkOrigin: false`; operator allowlist via `allowedOrigins: ["https://app.example.com"]`. Missing-Origin-AND-Missing-Referer (curl, server-to-server) defers to the token check. **Trusted Types in default CSP** (`b.middleware.securityHeaders`) — default CSP now includes `require-trusted-types-for 'script'; trusted-types 'allow-duplicates' default;`. Compatible browsers (Chrome 83+, Edge 83+) enforce typed-value DOM-sink writes (defends every untrusted-string-to-DOM XSS vector at runtime); Firefox + Safari ignore (no regression). Operators opt out by passing an explicit `csp:` value. **Expanded Permissions-Policy** — defaults now disable `browsing-topics=()`, `attribution-reporting=()`, `unload=()`, `interest-cohort=()`, `join-ad-interest-group=()`, `run-ad-auction=()`, `private-state-token-issuance=()`, `private-state-token-redemption=()`, `compute-pressure=()`, `hid=()`, `serial=()`, `idle-detection=()` — closes advertising / tracking / load-event-leak / device-API surfaces. Existing operator overrides via `permissionsPolicy: "..."` continue unchanged. **`__Host-` / `__Secure-` cookie prefix invariants** (`b.cookies.serialize`) — RFC 6265bis §4.1.3 enforced at serialize time. `__Secure-*` requires `secure: true`; `__Host-*` requires `secure: true` AND `path: "/"` AND no `domain:`. Each violation throws a typed `CookieError` with operator-actionable code (`cookies/prefix-secure-required`, `cookies/prefix-host-secure-required`, `cookies/prefix-host-path-required`, `cookies/prefix-host-no-domain`) instead of producing a malformed cookie that browsers silently reject. **`b.middleware.fetchMetadata`** — new fetch-metadata isolation primitive. Reads `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` and refuses cross-site state-changing requests by default. Operators opt in to specific destinations (e.g. `allowedDest: ["empty", "document"]`) or specific origins (`allowCrossSite: true`). Direct navigations (typed URL / bookmark — `Sec-Fetch-Site: none`) pass through; `same-origin` always passes; `same-site` configurable. Missing fetch-metadata (legacy browsers, server-to-server) deferred to other auth/CSRF layers per `allowMissing: true` default. Smoke 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.19** (2026-05-05) — auth-primitives batch (5 fixes): session idle/absolute timeout, JWT keyResolver for kid rotation, `b.middleware.bearerAuth`, `b.auth.jwt.verifyExternal` (classical-alg JWT verifier with JWKS support), and Argon2id parameter audit visibility. **Session idle + absolute timeouts** (`b.session.verify`) now enforce OWASP ASVS 5.0 §3.3 / NIST SP 800-63B-4 — defaults: 30 min idle, 12 hours absolute. Operators opt out per-call by passing `idleTimeoutMs: 0` / `absoluteTimeoutMs: 0`. Both surface `auth.session.expired_idle` / `auth.session.expired_absolute` audit events on enforcement. **JWT `keyResolver` opt** (`b.auth.jwt.verify`) — operator passes `keyResolver(decodedHeader)` to look up the public key per-token (typically by `kid`). Mutually exclusive with `opts.publicKey`. Async-friendly. Closes the kid-rotation gap where signers carried `kid` but verifiers only accepted a single static key. **`b.middleware.bearerAuth`** — new middleware that extracts `Authorization: Bearer <token>`, runs an operator-supplied `verify(token)` function, and attaches `req.user`. Distinct from cookie-session `attachUser`. Missing-Authorization passes through (so cookie path can take over); invalid/null/throw rejects 401 + `WWW-Authenticate: Bearer error="invalid_token"` per RFC 6750 §3. **`b.auth.jwt.verifyExternal`** — new generic classical-alg JWT verifier (RS256 / RS384 / RS512 / PS256 / PS384 / PS512 / ES256 / ES384 / ES512 / EdDSA) for integration with external IdPs (Auth0 / Okta / Keycloak / Cognito / Azure AD / Google / Apple). `algorithms` is REQUIRED with no default — defends the alg-confusion class (CVE-2024-54150 / CVE-2025-30144 / CVE-2026-22817 Hono). HMAC algs and `none` are explicitly refused (HMAC + JWKS public-key trust source IS the alg-confusion vector). Three key-source options: `jwks` (pre-fetched array), `jwksUri` (auto-fetched + TTL-cached via `b.httpClient` SSRF gate), `keyResolver` (custom). Standard claim checks (`exp` / `nbf` / `iat` / `aud` / `iss` / `sub`) with operator-tunable `clockSkewMs`. **`b.auth.password.params()`** — new accessor returning the active Argon2id params (`memoryCostKib` / `timeCost` / `parallelism`) plus the OWASP 2026 floor (`19 MiB` / `t>=2` / `p>=1`) plus `meetsFloor: bool`. Compliance-audit visibility without parsing PHC strings. Smoke 8458 → 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/index.js

@@ -1,4 +1,16 @@
 "use strict";
+
+// TLS 1.3 minimum, framework-wide. Sets the default for every TLS
+// socket the process opens — outbound (https.request, mail SMTP+
+// STARTTLS, redis/postgres/mongo with TLS, http-client) AND inbound
+// (https.createServer when blamejs is the listener). Per-call override
+// still works when an operator with a legacy peer needs TLSv1.2.
+// node:tls reads `DEFAULT_MIN_VERSION` once at first TLS use; setting
+// it here, before any framework module loads node:tls, makes the
+// default sticky for the entire process.
+var _tls = require("node:tls");
+_tls.DEFAULT_MIN_VERSION = "TLSv1.3";
+
 /**
  * blamejs — public API entry point.
  *
@@ -83,6 +95,8 @@ httpClient.encrypted = require("./lib/middleware/api-encrypt").httpClient;
 httpClient.cookieJar = require("./lib/http-client-cookie-jar");
 var websocket = require("./lib/websocket");
 var safeUrl = require("./lib/safe-url");
+var safeRedirect = require("./lib/safe-redirect");
+var pick = require("./lib/pick");
 var gateContract = require("./lib/gate-contract");
 var guardCsv = require("./lib/guard-csv");
 var guardHtml = require("./lib/guard-html");
@@ -220,6 +234,8 @@ module.exports = {
   httpClient:       httpClient,
   websocket:        websocket,
   safeUrl:          safeUrl,
+  safeRedirect:     safeRedirect,
+  pick:             pick,
   gateContract:     gateContract,
   guardCsv:         guardCsv,
   guardHtml:        guardHtml,

package/lib/audit-sign.js

@@ -77,12 +77,11 @@ var _err = AuditSignError.factory;
 
 // Default for newly-generated keys. Operators can override at init
 // via opts.algorithm — e.g. `auditSigning: { algorithm: "ml-dsa-87" }`
-// for throughput-sensitive deployments. Existing key files determine
-// their own algorithm via the on-disk `algorithm` field; legacy key
-// files that predate the algorithm field load as "ml-dsa-87" (the
-// previous implicit default).
+// for throughput-sensitive deployments. Every key file MUST carry the
+// `algorithm` field on disk — the framework refuses to load a key file
+// that lacks it. The legacy implicit-default-to-ml-dsa-87 fallback was
+// removed as part of the pre-v1 compat-shim sweep.
 var DEFAULT_SIGNING_ALG = "slh-dsa-shake-256f";
-var LEGACY_DEFAULT_ALG  = "ml-dsa-87";
 var SUPPORTED_SIGNING_ALGS = Object.freeze(["slh-dsa-shake-256f", "ml-dsa-87"]);
 
 var SIGNING_KEY_SCHEMA = {
@@ -202,11 +201,16 @@ function _initPlaintext() {
       throw _err("KEY_FILE_CORRUPT",
         "audit-sign.key corrupted or schema-invalid at " + paths.plaintext + " - " + e.message);
     }
-    var loadedAlg = loaded.algorithm || LEGACY_DEFAULT_ALG;
+    if (typeof loaded.algorithm !== "string" || loaded.algorithm.length === 0) {
+      throw _err("KEY_FILE_MISSING_ALG",
+        "audit-sign.key at " + paths.plaintext + " is missing the required " +
+        "`algorithm` field. Regenerate the keypair (deletes the file and " +
+        "boots fresh) or hand-edit to add `\"algorithm\": \"slh-dsa-shake-256f\"`.");
+    }
     keys = {
       publicKey:  loaded.publicKey,
       privateKey: loaded.privateKey,
-      algorithm:  loadedAlg,
+      algorithm:  loaded.algorithm,
       fingerprint: _computeFingerprint(loaded.publicKey),
     };
     return;
@@ -248,14 +252,17 @@ async function _initWrapped() {
       throw _err("UNWRAPPED_INVALID",
         "unwrapped audit-sign.key invalid: " + e.message);
     }
-    var loadedAlg = loaded.algorithm || LEGACY_DEFAULT_ALG;
+    if (typeof loaded.algorithm !== "string" || loaded.algorithm.length === 0) {
+      throw _err("UNWRAPPED_MISSING_ALG",
+        "unwrapped audit-sign.key is missing the required `algorithm` field.");
+    }
     keys = {
       publicKey:  loaded.publicKey,
       privateKey: loaded.privateKey,
-      algorithm:  loadedAlg,
+      algorithm:  loaded.algorithm,
       fingerprint: _computeFingerprint(loaded.publicKey),
     };
-    log("audit-signing keypair unsealed (alg=" + loadedAlg + ").");
+    log("audit-signing keypair unsealed (alg=" + loaded.algorithm + ").");
   } finally {
     // The audit-signing passphrase is single-use at boot — no re-wrap path
     // keeps it alive (unlike vault.currentPassphrase). Zero on the way out.

package/lib/pick.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * b.pick — mass-assignment (CWE-915 / OWASP API3:2023) defense.
+ *
+ * The vulnerability: a route accepting `JSON` body and passing
+ * `req.body` straight to a DB write lets an attacker include fields
+ * the operator never intended (`isAdmin`, `passwordHash`, `userId`).
+ * This primitive is the operator's allowlist of acceptable fields —
+ * pass req.body through it before persisting.
+ *
+ *   var safeUserUpdate = b.pick(req.body, [
+ *     "displayName", "bio", "avatarUrl",
+ *   ]);
+ *   await db.users.update(userId, safeUserUpdate);
+ *
+ * Returns a NEW object containing only the keys in the allowlist.
+ * Keys not present in the input are simply absent from the output —
+ * no defaults filled in, no `undefined` values. Prototype-pollution
+ * keys (`__proto__` / `constructor` / `prototype`) are ALWAYS
+ * stripped, even if the operator accidentally lists them.
+ *
+ *   var partial = b.pick(req.body, ["a", "b"], { onUnknown: "throw" });
+ *   // throws if req.body has any key NOT in ["a", "b"]
+ *
+ *   var nested = b.pick(req.body, [
+ *     "name",
+ *     ["profile", ["bio", "url"]],     // nested allowlist for `profile.*`
+ *   ]);
+ */
+
+var POISONED_KEYS = ["__proto__", "constructor", "prototype"];
+
+function _isPlainObject(o) {
+  return o !== null && typeof o === "object" && !Array.isArray(o) &&
+         (Object.getPrototypeOf(o) === Object.prototype ||
+          Object.getPrototypeOf(o) === null);
+}
+
+function _normalizeAllowList(list) {
+  // Accept either ["a","b"] or [["nested",["sub1","sub2"]]] — return
+  // a Map<key, allowList | true>.
+  var out = Object.create(null);
+  for (var i = 0; i < list.length; i += 1) {
+    var entry = list[i];
+    if (typeof entry === "string") {
+      if (POISONED_KEYS.indexOf(entry) !== -1) continue;
+      out[entry] = true;
+    } else if (Array.isArray(entry) && entry.length === 2 &&
+               typeof entry[0] === "string" && Array.isArray(entry[1])) {
+      if (POISONED_KEYS.indexOf(entry[0]) !== -1) continue;
+      out[entry[0]] = _normalizeAllowList(entry[1]);
+    } else {
+      throw new TypeError(
+        "b.pick: allowlist entry must be a string or [name, [...]]; got " +
+        JSON.stringify(entry));
+    }
+  }
+  return out;
+}
+
+function _pickInner(input, normalized, onUnknown, path) {
+  if (!_isPlainObject(input)) {
+    return _isPlainObject(input) ? {} : input;
+  }
+  var output = Object.create(null);
+  var keys = Object.keys(input);
+  for (var i = 0; i < keys.length; i += 1) {
+    var k = keys[i];
+    if (POISONED_KEYS.indexOf(k) !== -1) continue;
+    if (!Object.prototype.hasOwnProperty.call(normalized, k)) {
+      if (onUnknown === "throw") {
+        throw new TypeError(
+          "b.pick: unknown key '" + (path ? path + "." : "") + k +
+          "' not in allowlist");
+      }
+      continue;
+    }
+    var rule = normalized[k];
+    if (rule === true) {
+      output[k] = input[k];
+    } else {
+      // Nested allowlist.
+      output[k] = _isPlainObject(input[k])
+        ? _pickInner(input[k], rule, onUnknown, (path ? path + "." : "") + k)
+        : input[k];
+    }
+  }
+  // Convert to a plain Object (output is currently null-prototype) so
+  // downstream JSON serializers / DB drivers see a normal-shape object.
+  return Object.assign({}, output);
+}
+
+function pick(input, allowList, opts) {
+  opts = opts || {};
+  if (!Array.isArray(allowList)) {
+    throw new TypeError("b.pick: second argument must be an array of allowed keys");
+  }
+  var onUnknown = opts.onUnknown === "throw" ? "throw" : "drop";
+  var normalized = _normalizeAllowList(allowList);
+  return _pickInner(input, normalized, onUnknown, "");
+}
+
+module.exports = pick;
+module.exports.pick = pick;
+module.exports.POISONED_KEYS = Object.freeze(POISONED_KEYS.slice());

package/lib/safe-redirect.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * safe-redirect — open-redirect (CWE-601) defense for operator-supplied
+ * post-login `?next=` / `?return_to=` parameters and similar redirect
+ * targets.
+ *
+ * The vulnerability: an attacker phishes a victim with a link like
+ * `https://app.example.com/login?next=https://attacker.example.com`.
+ * After login, a naive `res.writeHead(302, { Location: req.query.next })`
+ * sends the user to attacker.example.com under the trust of app.example.com.
+ *
+ *   var safe = b.safeRedirect.resolve(rawNext, {
+ *     base:           "https://app.example.com",
+ *     allowedOrigins: ["https://app.example.com"],
+ *     allowedHosts:   ["app.example.com"],
+ *     fallback:       "/dashboard",
+ *   });
+ *   // → safe path or fallback (never attacker.example.com)
+ *
+ * Decision rules (in order):
+ *
+ *   1. rawTarget is null / empty / non-string → fallback
+ *   2. rawTarget starts with "//" or "\\" → fallback (protocol-relative
+ *      open redirect — `//attacker.com/path` interpreted as
+ *      `https://attacker.com/path` by browsers)
+ *   3. rawTarget contains a control char / null / CR / LF → fallback
+ *      (header-injection vector)
+ *   4. rawTarget is a relative path starting with "/" → safe (same-
+ *      origin by definition)
+ *   5. rawTarget is a fragment / search-only ("#x" / "?q=1") → safe
+ *   6. rawTarget is a full URL → parse + check origin against
+ *      allowedOrigins (or host against allowedHosts when the operator
+ *      doesn't care about scheme/port match)
+ *   7. anything else (data:, javascript:, malformed) → fallback
+ *
+ * Returns the safe URL string (path + query + fragment for relative;
+ * full URL for allowed full URLs; fallback otherwise). Operators
+ * pass the result directly to `res.writeHead(302, { Location: ... })`.
+ */
+
+var safeUrl = require("./safe-url");
+var validateOpts = require("./validate-opts");
+
+var DEFAULT_FALLBACK = "/";
+
+function _hasControlChar(s) {
+  for (var i = 0; i < s.length; i += 1) {
+    var c = s.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return true;                                     // allow:raw-byte-literal — ASCII control range thresholds
+  }
+  return false;
+}
+
+function resolve(rawTarget, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["base", "allowedOrigins", "allowedHosts", "fallback"], "safeRedirect.resolve");
+
+  var fallback = typeof opts.fallback === "string" ? opts.fallback : DEFAULT_FALLBACK;
+  if (typeof rawTarget !== "string" || rawTarget.length === 0) return fallback;
+  if (_hasControlChar(rawTarget)) return fallback;
+
+  // Reject protocol-relative ("//host/...") and back-slash variant
+  // ("\\host\..." — IE / older browsers may interpret as auth).
+  if (rawTarget.length >= 2) {
+    var p0 = rawTarget.charAt(0);
+    var p1 = rawTarget.charAt(1);
+    if ((p0 === "/" || p0 === "\\") && (p1 === "/" || p1 === "\\")) return fallback;
+  }
+
+  // Same-origin relative (path / query / fragment) — safe by definition.
+  if (rawTarget.charAt(0) === "/" || rawTarget.charAt(0) === "?" ||
+      rawTarget.charAt(0) === "#") {
+    return rawTarget;
+  }
+
+  // Full URL — parse and check against allowlist.
+  var allowedOrigins = Array.isArray(opts.allowedOrigins) ? opts.allowedOrigins : null;
+  var allowedHosts   = Array.isArray(opts.allowedHosts)   ? opts.allowedHosts   : null;
+  if (!allowedOrigins && !allowedHosts) {
+    // Operator gave no allowlist — refuse all full URLs (the safe default).
+    return fallback;
+  }
+
+  var parsed;
+  try { parsed = safeUrl.parse(rawTarget, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS }); }
+  catch (_e) { return fallback; }
+
+  if (allowedOrigins) {
+    for (var i = 0; i < allowedOrigins.length; i += 1) {
+      if (parsed.origin === allowedOrigins[i]) return rawTarget;
+    }
+  }
+  if (allowedHosts) {
+    for (var j = 0; j < allowedHosts.length; j += 1) {
+      if (parsed.host === allowedHosts[j] || parsed.hostname === allowedHosts[j]) {
+        return rawTarget;
+      }
+    }
+  }
+  return fallback;
+}
+
+module.exports = {
+  resolve:           resolve,
+  DEFAULT_FALLBACK:  DEFAULT_FALLBACK,
+};

package/lib/webhook.js

@@ -198,17 +198,37 @@ function _hmacVerify(key, data, expectedHex) {
   return crypto.timingSafeEqual(actualHex, expectedHex);
 }
 
+// PQC signatures encode as base64url. SLH-DSA-SHAKE-256f signatures
+// are ~29.5 KB binary → ~59 KB hex but only ~40 KB base64url. The hex
+// form blew past common front-end limits (nginx default 8 KB / Cloudflare
+// default 16 KB / many CDN edge limits 32 KB). base64url keeps the
+// signature in-header for the bulk of operators while still allowing
+// body-bound signatures (operator passes the wire-encoded sig in body
+// when even base64url is too large for their topology).
+//
+// Verification accepts EITHER encoding for a transition window: a
+// base64url-shaped value is decoded as base64url; otherwise a hex-
+// shaped value is decoded as hex. New signatures are emitted as
+// base64url; old hex-encoded signatures still verify.
 function _pqcSign(privateKeyPem, data) {
-  return crypto.sign(data, privateKeyPem).toString("hex");
+  return crypto.sign(data, privateKeyPem).toString("base64url");
 }
 
-function _pqcVerify(publicKeyPem, data, expectedHex) {
-  if (!safeBuffer.isHex(expectedHex) || (expectedHex.length % 2) !== 0) {
-    return false;
-  }
+var _BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+
+function _pqcVerify(publicKeyPem, data, expectedSig) {
+  if (typeof expectedSig !== "string" || expectedSig.length === 0) return false;
   var sigBuf;
-  try { sigBuf = Buffer.from(expectedHex, "hex"); }
-  catch (_e) { return false; }
+  try {
+    if (_BASE64URL_RE.test(expectedSig) &&                                       // allow:regex-no-length-cap — sig length bounded by header parser cap
+        !/^[0-9a-f]+$/.test(expectedSig)) {                                      // allow:regex-no-length-cap — same
+      sigBuf = Buffer.from(expectedSig, "base64url");
+    } else if (safeBuffer.isHex(expectedSig) && (expectedSig.length % 2) === 0) {
+      sigBuf = Buffer.from(expectedSig, "hex");
+    } else {
+      return false;
+    }
+  } catch (_e) { return false; }
   try { return crypto.verify(data, sigBuf, publicKeyPem); }
   catch (_e) { return false; }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.20",
+  "version": "0.7.21",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:be5934ef-c4b9-4516-a8ee-b8bb2c31ee26",
+  "serialNumber": "urn:uuid:e04975c4-d3d5-4299-aad3-3e7d44ea1d43",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T05:52:29.844Z",
+    "timestamp": "2026-05-05T06:06:29.999Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.20",
+      "bom-ref": "@blamejs/core@0.7.21",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.20",
+      "version": "0.7.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.20",
+      "purl": "pkg:npm/%40blamejs/core@0.7.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.20",
+      "ref": "@blamejs/core@0.7.21",
       "dependsOn": []
     }
   ]