@blamejs/core 0.8.0 → 0.8.5

package/lib/retention.js

@@ -58,6 +58,7 @@
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var safeSql = require("./safe-sql");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -66,6 +67,21 @@ var cryptoField = require("./crypto-field");
 var RetentionError = defineClass("RetentionError", { alwaysPermanent: true });
 var _err = RetentionError.factory;
 
+// Identifier-level SQLi defense: every operator-supplied table name,
+// column name, and cascade FK must pass safeSql.validateIdentifier
+// before reaching SQL string concatenation. Without this gate a
+// rule registered with `table: 'users"; DROP TABLE audit_log;--'`
+// would break out of the quoted-identifier wrap and execute the
+// embedded statement.
+function _validateRuleIdentifier(value, label) {
+  try {
+    safeSql.validateIdentifier(value, { allowReserved: true });
+  } catch (e) {
+    throw _err("BAD_RULE",
+      label + " is not a safe SQL identifier: " + (e && e.message || String(e)));
+  }
+}
+
 function _validateRule(rule) {
   if (!rule || typeof rule !== "object") {
     throw _err("BAD_RULE", "rule must be an object");
@@ -76,9 +92,11 @@ function _validateRule(rule) {
   if (typeof rule.table !== "string" || rule.table.length === 0) {
     throw _err("BAD_RULE", "rule.table (string) is required");
   }
+  _validateRuleIdentifier(rule.table, "rule.table");
   if (typeof rule.ageField !== "string" || rule.ageField.length === 0) {
     throw _err("BAD_RULE", "rule.ageField (string) is required");
   }
+  _validateRuleIdentifier(rule.ageField, "rule.ageField");
   if (typeof rule.ttlMs !== "number" || !isFinite(rule.ttlMs) || rule.ttlMs <= 0) {
     throw _err("BAD_RULE", "rule.ttlMs must be a positive finite number");
   }
@@ -99,10 +117,16 @@ function _validateRule(rule) {
       (typeof rule.softDeleteField !== "string" || rule.softDeleteField.length === 0)) {
     throw _err("BAD_RULE", "rule.softDeleteField must be a non-empty string");
   }
+  if (rule.softDeleteField !== undefined) {
+    _validateRuleIdentifier(rule.softDeleteField, "rule.softDeleteField");
+  }
   if (rule.legalHoldField !== undefined &&
       (typeof rule.legalHoldField !== "string" || rule.legalHoldField.length === 0)) {
     throw _err("BAD_RULE", "rule.legalHoldField must be a non-empty string");
   }
+  if (rule.legalHoldField !== undefined) {
+    _validateRuleIdentifier(rule.legalHoldField, "rule.legalHoldField");
+  }
   if (rule.cascade !== undefined) {
     if (!Array.isArray(rule.cascade) || rule.cascade.length === 0) {
       throw _err("BAD_RULE", "rule.cascade must be a non-empty array of { table, foreignKey } entries");
@@ -113,6 +137,8 @@ function _validateRule(rule) {
           typeof c.foreignKey !== "string" || c.foreignKey.length === 0) {
         throw _err("BAD_RULE", "rule.cascade[" + ci + "] must be { table: string, foreignKey: string }");
       }
+      _validateRuleIdentifier(c.table, "rule.cascade[" + ci + "].table");
+      _validateRuleIdentifier(c.foreignKey, "rule.cascade[" + ci + "].foreignKey");
     }
   }
   if (rule.stages !== undefined) {

package/lib/router.js

@@ -651,6 +651,7 @@ class Router {
         maxHeaderListPairs:        100,                                            // allow:raw-byte-literal — CVE-2024-27983 CONTINUATION-flood cap
         maxSettings:               32,                                             // allow:raw-byte-literal — SETTINGS-frame entry ceiling
         peerMaxConcurrentStreams:  100,                                            // allow:raw-byte-literal — peer-side stream cap
+        maxOutstandingPings:       10,                                             // allow:raw-byte-literal — CVE-2019-9512 ping-flood cap (pin to Node default rather than letting it drift)
         unknownProtocolTimeout:    C.TIME.seconds(10),
       }, tlsOptions), requestHandler);
     } else {

package/lib/scheduler.js

@@ -682,8 +682,63 @@ function create(opts) {
     started = false;
   }
 
-  return {
+  // Shorthand for the common interval-based registration shape:
+  //   register("rotate-keys", C.TIME.minutes(5), runFn)
+  // is equivalent to schedule({ name, every: 300000, run: runFn }).
+  // Operators wanting cron expressions or job-queue dispatch keep
+  // using schedule() — register() is the every-N-ms direct-function
+  // path. Returns the scheduler instance for method chaining.
+  function register(name, intervalMs, fn) {
+    if (typeof name !== "string" || name.length === 0) {
+      throw _err("INVALID_NAME", "scheduler.register: name must be a non-empty string", true);
+    }
+    if (typeof intervalMs !== "number" || !Number.isFinite(intervalMs) || intervalMs < C.TIME.seconds(1)) {
+      throw _err("INVALID_SPEC",
+        "scheduler.register: intervalMs must be a finite number ≥ 1000", true);
+    }
+    if (typeof fn !== "function") {
+      throw _err("INVALID_SPEC", "scheduler.register: fn must be a function", true);
+    }
+    schedule({ name: name, every: intervalMs, run: fn });
+    return facade;
+  }
+
+  // Operator-facing health surface — every task with its lifecycle
+  // counters plus an aggregate. Probes / dashboards / readiness gates
+  // get a single object they can serialize. This is `list()` plus
+  // started state and aggregate stats.
+  function getStatus() {
+    var taskList = list();
+    var aggregate = {
+      total:          taskList.length,
+      running:        0,
+      withErrors:     0,
+      totalFires:     0,
+      totalMisses:    0,
+      nonLeaderSkips: 0,
+      tickClaimLost:  0,
+    };
+    for (var i = 0; i < taskList.length; i++) {
+      var t = taskList[i];
+      if (t.running)        aggregate.running        += 1;
+      if (t.lastError)      aggregate.withErrors     += 1;
+      aggregate.totalFires      += t.fires || 0;
+      aggregate.totalMisses     += t.misses || 0;
+      aggregate.nonLeaderSkips  += t.nonLeaderSkips || 0;
+      aggregate.tickClaimLost   += t.tickClaimLost || 0;
+    }
+    return {
+      started:   started,
+      isLeader:  _isLeaderHere(),
+      tasks:     taskList,
+      aggregate: aggregate,
+    };
+  }
+
+  var facade = {
     schedule:      schedule,
+    register:      register,
+    getStatus:     getStatus,
     start:         start,
     stop:          stop,
     list:          list,
@@ -695,6 +750,7 @@ function create(opts) {
     },
     _resetForTest: _resetForTest,
   };
+  return facade;
 }
 
 module.exports = {

package/lib/session.js

@@ -238,7 +238,7 @@ async function verify(token, verifyOpts) {
     if ((nowMs - lastActivity) > idleMs) {
       try {
         audit.safeEmit({
-          action: "auth.session.expired_idle", outcome: "warning",
+          action: "auth.session.expired_idle", outcome: "success",
           metadata: { idleMs: nowMs - lastActivity, threshold: idleMs },
         });
       } catch (_ignored) { /* audit best-effort */ }
@@ -253,7 +253,7 @@ async function verify(token, verifyOpts) {
     if ((nowMs - createdAt) > absMs) {
       try {
         audit.safeEmit({
-          action: "auth.session.expired_absolute", outcome: "warning",
+          action: "auth.session.expired_absolute", outcome: "success",
           metadata: { ageMs: nowMs - createdAt, threshold: absMs },
         });
       } catch (_ignored) { /* audit best-effort */ }
@@ -334,7 +334,7 @@ async function verify(token, verifyOpts) {
       try {
         audit.safeEmit({
           action:   "auth.session.fingerprint_drift",
-          outcome:  "warning",
+          outcome:  "success",
           metadata: { hasUserId: !!unsealed.userId,
             anomalyScore: fingerprintAnomalyScore },
         });

package/lib/ssrf-guard.js

@@ -140,10 +140,25 @@ var CLOUD_METADATA_IPS = [
 
 function _ipv4ToInt(ip) {
   var parts = ip.split(".");
-  return ((parts[0] | 0) << 24 >>> 0) +
-         ((parts[1] | 0) << 16) +
-         ((parts[2] | 0) << 8) +
-          (parts[3] | 0);
+  if (parts.length !== 4) return NaN;
+  var nums = [0, 0, 0, 0];
+  for (var i = 0; i < 4; i += 1) {
+    var s = parts[i];
+    // Strict octet validation: each segment must be 1-3 ASCII digits
+    // representing 0-255. The previous `parts[i] | 0` coerced
+    // anything non-numeric to 0 silently — exposed via cidrContains
+    // (network-allowlist) where a typo'd CIDR could collapse to
+    // 0.0.0.0/16 with no signal.
+    if (typeof s !== "string" || s.length === 0 || s.length > 3) return NaN;
+    if (!/^\d{1,3}$/.test(s)) return NaN;
+    var n = parseInt(s, 10);
+    if (n < 0 || n > 255) return NaN;
+    nums[i] = n;
+  }
+  return ((nums[0] << 24) >>> 0) +
+         (nums[1] << 16) +
+         (nums[2] << 8) +
+          nums[3];
 }
 
 function _ipv6ToBytes(ip) {

package/lib/static.js

@@ -100,6 +100,12 @@ var DEFAULT_CONTENT_TYPES = {
 var DEFAULTS = Object.freeze({
   defaultMaxAge:                    DEFAULT_MAX_AGE_SEC,
   acceptRanges:                     true,
+  // Per-range byte cap — slowloris-range defense. A single Range
+  // request that asks for 1 GiB pins a worker on a long read; many
+  // concurrent requests asking for the same exhaust the process pool.
+  // The cap rejects ranges larger than maxRangeBytes with 416. Set to
+  // Infinity to opt out (audited reason).
+  maxRangeBytes:                    C.BYTES.mib(64),
   // Empty array = no MIME allowlist gate.
   allowedFileTypes:                 Object.freeze([]),
   // Bandwidth + concurrency caps default to 0 = "no cap". Operators opt
@@ -844,6 +850,12 @@ function create(opts) {
           return _writeError(res, HTTP.RANGE_NOT_SATISFIABLE, "range_not_satisfiable",
             "Range Not Satisfiable", { "Content-Range": "bytes */" + meta.size });
         }
+        if (range && cfg.maxRangeBytes !== Infinity && range.length > cfg.maxRangeBytes) {
+          stats.failures += 1;
+          _emitObs("staticServe.range_too_large", 1, { route: urlPath });
+          return _writeError(res, HTTP.RANGE_NOT_SATISFIABLE, "range_too_large",
+            "Range Not Satisfiable", { "Content-Range": "bytes */" + meta.size });
+        }
         if (range) {
           stats.rangeRequests += 1;
           _emitObs("staticServe.range_requests", 1, { route: urlPath });

package/lib/totp.js

@@ -134,6 +134,22 @@ function _resolveOpts(opts) {
     throw new AuthError("auth-totp/bad-alg",
       "algorithm must be one of " + SUPPORTED_ALGORITHMS.join(", ") + " (got: " + alg + ")");
   }
+  // SHA-256 is supported for back-compat with authenticator apps that
+  // don't yet honor SHA-512. Emit an audit signal each time it's
+  // selected so operator compliance dashboards see which accounts run
+  // on the weaker hash and can plan the migration.
+  if (alg === "sha256") {
+    setImmediate(function () {
+      try {
+        var auditMod = require("./audit");                                          // allow:inline-require — circular-load defense
+        auditMod.safeEmit({
+          action:   "auth.totp.algorithm_downgraded",
+          outcome:  "success",
+          metadata: { algorithm: alg, frameworkDefault: DEFAULT_ALGORITHM },
+        });
+      } catch (_e) { /* drop-silent */ }
+    });
+  }
   var digits = opts.digits != null ? opts.digits : DEFAULT_DIGITS;
   if (typeof digits !== "number" || digits < 6 || digits > 10) {
     throw new AuthError("auth-totp/bad-digits", "digits must be 6–10 (got: " + digits + ")");

package/lib/ws-client.js

@@ -58,6 +58,8 @@ var fwCrypto       = lazyRequire(function () { return require("./crypto"); });
 var websocket      = lazyRequire(function () { return require("./websocket"); });
 var audit          = lazyRequire(function () { return require("./audit"); });
 var networkTls     = lazyRequire(function () { return require("./network-tls"); });
+var safeJson       = lazyRequire(function () { return require("./safe-json"); });
+var ssrfGuard      = require("./ssrf-guard");
 var C              = require("./constants");
 var { defineClass } = require("./framework-error");
 
@@ -164,9 +166,27 @@ function connect(target, opts) {
     "maxMessageBytes", "maxFrameBytes",
     "handshakeTimeoutMs", "reconnect",
     "permessageDeflate", "audit", "origin",
-    "handshakeGuid",
+    "handshakeGuid", "allowInternal",
+    "parse", "parser",
+    "urlFor", "tlsOptsFor",
   ], "wsClient.connect");
 
+  // Per-dial state-injection callbacks. Both fire on every connect
+  // attempt (initial + each reconnect) so operators can rotate
+  // bearer tokens, DNS targets, or TLS material between hops without
+  // tearing the client down.
+  //   urlFor(attempt) -> string                — overrides target URL
+  //   tlsOptsFor(attempt) -> object            — overrides TLS opts
+  // attempt is a 0-based hop index; 0 is the initial dial.
+  if (opts.urlFor != null && typeof opts.urlFor !== "function") {
+    throw new WsClientError("ws-client/bad-url-for",
+      "wsClient.connect: urlFor must be a function");
+  }
+  if (opts.tlsOptsFor != null && typeof opts.tlsOptsFor !== "function") {
+    throw new WsClientError("ws-client/bad-tls-opts-for",
+      "wsClient.connect: tlsOptsFor must be a function");
+  }
+
   // Operators with a non-RFC-6455 GUID (private protocols on top of
   // the WebSocket framing layer, framework-specific handshake variants)
   // pass a custom handshakeGuid. The server-side b.websocket already
@@ -219,8 +239,29 @@ function connect(target, opts) {
     permessageDeflate:  permessageDeflate,
     auditOn:            auditOn,
     handshakeGuid:      handshakeGuid,
+    allowInternal:      opts.allowInternal,
+    parse:              opts.parse || null,
+    parser:             typeof opts.parser === "function" ? opts.parser : null,
+    urlFor:             typeof opts.urlFor === "function" ? opts.urlFor : null,
+    tlsOptsFor:         typeof opts.tlsOptsFor === "function" ? opts.tlsOptsFor : null,
+  });
+  // SSRF gate — refuse private / loopback / link-local / cloud-metadata /
+  // reserved IP destinations by default. Symmetric to b.httpClient. The
+  // returned `ips` are pinned through tls.connect / net.connect so the
+  // actual TCP connect targets the validated address (closes the DNS-
+  // rebinding TOCTOU window). Cloud-metadata IPs are unconditional
+  // hard-deny — `allowInternal: true` does not bypass them.
+  var hostnameForUrl = parsed.protocol === "wss:" ? "https:" : "http:";
+  var probeUrl = new url.URL(hostnameForUrl + "//" + parsed.host + parsed.pathname + parsed.search);
+  ssrfGuard.checkUrl(probeUrl, {
+    allowInternal: opts.allowInternal,
+    errorClass:    WsClientError,
+  }).then(function (result) {
+    client._ssrfPinnedIps = result && result.ips;
+    client._dial();
+  }).catch(function (e) {
+    setImmediate(function () { client._handleSocketError(e); });
   });
-  client._dial();
   return client;
 }
 
@@ -278,13 +319,74 @@ class WsClient extends EventEmitter {
     var opts = this._opts;
     this._readyState = "connecting";
 
-    var parsed = opts.parsedUrl;
+    // Per-dial overrides — urlFor swaps the target URL, tlsOptsFor
+    // overrides TLS material. Both fire every dial including reconnects
+    // so callers can rotate state. urlFor's result is re-validated
+    // through ssrfGuard so a hostile upstream can't direct the client
+    // at a private address mid-reconnect.
+    var attempt = this._reconnectAttempt || 0;
+    var dialTarget = opts.target;
+    var dialParsed = opts.parsedUrl;
+    if (typeof opts.urlFor === "function") {
+      try {
+        var nextTarget = opts.urlFor(attempt);
+        if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== dialTarget) {
+          dialParsed = _parseUrl(nextTarget);
+          dialTarget = nextTarget;
+          var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
+          var probeUrl = new url.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
+          var probe = ssrfGuard.checkUrl(probeUrl, {
+            allowInternal: opts.allowInternal,
+            errorClass:    WsClientError,
+          });
+          this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
+        }
+      } catch (e) {
+        return self._handleSocketError(e);
+      }
+    }
+
+    var dialTlsOpts = opts.tlsOpts;
+    if (typeof opts.tlsOptsFor === "function") {
+      try {
+        var override = opts.tlsOptsFor(attempt);
+        if (override && typeof override === "object") {
+          dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
+        }
+      } catch (e) {
+        return self._handleSocketError(e);
+      }
+    }
+
+    var parsed = dialParsed;
     var port = parsed.port ? parseInt(parsed.port, 10) :
                (parsed.protocol === "wss:" ? 443 : 80);                                  // allow:raw-byte-literal — TLS / HTTP default port
     var host = parsed.hostname;
 
     function _onError(err) { self._handleSocketError(err); }
 
+    // Pin the connect to the SSRF-validated IPs returned by
+    // ssrfGuard.checkUrl — closes the DNS-rebinding TOCTOU window where
+    // the gate resolves a public IP and the kernel re-resolves to a
+    // private one between the check and the connect.
+    var pinnedIps = self._ssrfPinnedIps || null;
+    var lookup = null;
+    if (pinnedIps && pinnedIps.length > 0) {
+      lookup = function (h, lookupOpts, cb) {
+        // Node's lookup callback signatures:
+        //   (err, address, family) for legacy { all: false } (default)
+        //   (err, addresses)        for { all: true }
+        if (typeof lookupOpts === "function") { cb = lookupOpts; lookupOpts = {}; }
+        var first = pinnedIps[0];
+        if (lookupOpts && lookupOpts.all) {
+          return cb(null, pinnedIps.map(function (ip) {
+            return { address: ip.address, family: ip.family };
+          }));
+        }
+        return cb(null, first.address, first.family);
+      };
+    }
+
     var socket;
     if (parsed.protocol === "wss:") {
       var tls = require("tls");                                                          // allow:inline-require — node:tls only on TLS path
@@ -294,7 +396,8 @@ class WsClient extends EventEmitter {
         servername:   host,
         rejectUnauthorized: true,
         minVersion:   "TLSv1.3",
-      }, opts.tlsOpts || {});
+      }, dialTlsOpts || {});
+      if (lookup) tlsOpts.lookup = lookup;
       try {
         var pqcShares = networkTls().pqc.getKeyShares();
         if (Array.isArray(pqcShares) && pqcShares.length > 0 && !tlsOpts.curves) {
@@ -303,7 +406,9 @@ class WsClient extends EventEmitter {
       } catch (_e) { /* drop-silent — tls module pre-init or non-Node */ }
       socket = tls.connect(tlsOpts);
     } else {
-      socket = net.connect({ host: host, port: port });
+      var netOpts = { host: host, port: port };
+      if (lookup) netOpts.lookup = lookup;
+      socket = net.connect(netOpts);
     }
     this._socket = socket;
     socket.on("error", _onError);
@@ -406,8 +511,17 @@ class WsClient extends EventEmitter {
     }
     var status = parseInt(match[1], 10);
     if (status !== 101) {                                                                 // allow:raw-byte-literal — HTTP 101
-      this._handleSocketError(new WsClientError("ws-client/bad-status",
-        "handshake response status was " + status + " (expected 101 Switching Protocols)"));
+      // Body bytes after the header section are the server's
+      // explanation. Surface them on the error so callers can branch
+      // on the status code and inspect the body without re-parsing
+      // the message string.
+      var bodyText = "";
+      try { bodyText = rest.toString("utf8"); } catch (_e) { /* drop-silent */ }
+      var statusErr = new WsClientError("ws-client/bad-status",
+        "handshake response status was " + status + " (expected 101 Switching Protocols)");
+      statusErr.status = status;
+      statusErr.body = bodyText;
+      this._handleSocketError(statusErr);
       return;
     }
 
@@ -624,7 +738,29 @@ class WsClient extends EventEmitter {
           return;
         }
       }
-      this.emit("message", data, isBinary);
+      // Auto-parse text frames as JSON when the operator opted in via
+      // `parse: "json"` or supplied `parser: fn`. JSON-only protocols
+      // (most modern WS APIs) get a typed message argument without a
+      // wrapper layer; parse failures surface as 'error' events
+      // rather than crashing the message handler.
+      var parsed = data;
+      var parsedOk = true;
+      if (!isBinary && this._opts.parse === "json") {
+        try { parsed = safeJson().parse(data, { maxBytes: this._opts.maxMessageBytes }); }
+        catch (e) {
+          parsedOk = false;
+          this.emit("error", new WsClientError("ws-client/json-parse",
+            "text frame is not valid JSON: " + ((e && e.message) || String(e))));
+        }
+      } else if (!isBinary && typeof this._opts.parser === "function") {
+        try { parsed = this._opts.parser(data); }
+        catch (e) {
+          parsedOk = false;
+          this.emit("error", new WsClientError("ws-client/parser-failed",
+            "operator parser threw: " + ((e && e.message) || String(e))));
+        }
+      }
+      if (parsedOk) this.emit("message", parsed, isBinary);
     }
   }
 
@@ -741,12 +877,25 @@ class WsClient extends EventEmitter {
   }
 
   _handleSocketError(err) {
+    // Swallow post-close socket errors. After a consumer-initiated
+    // close() the framework waits for the server to send back its
+    // close frame; if the server tears down its end with an
+    // ECONNRESET / EPIPE / "premature close" instead of a graceful
+    // close frame, the underlying socket emits an error that bubbles
+    // up here. From the consumer's perspective the close already
+    // happened — surfacing a "socket error" event after `close` was
+    // called is noise that hides real bugs.
+    if (this._closed && err && (
+        err.code === "ECONNRESET" || err.code === "EPIPE" ||
+        err.code === "ECONNABORTED" || err.code === "ERR_STREAM_PREMATURE_CLOSE")) {
+      return;
+    }
     var permanent = _isPermanentError(err);
     if (this._opts.auditOn) {
       try {
         audit().safeEmit({
           action:  "wsclient.error",
-          outcome: "fail",
+          outcome: "failure",
           actor:   null,
           metadata: {
             host:     this._opts.parsedUrl.host,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.8.0",
+  "version": "0.8.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -70,7 +70,8 @@
   ],
   "scripts": {
     "test": "node test/smoke.js",
-    "prepack": "node scripts/check-pack-against-gitignore.js"
+    "prepack": "node scripts/check-pack-against-gitignore.js",
+    "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },
   "dependencies": {},
   "devDependencies": {}

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4bde75d4-1385-4f13-b927-d67aa27d910d",
+  "serialNumber": "urn:uuid:1f60d33c-fc3b-4da1-a753-bb1c98de9968",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-06T18:52:54.402Z",
+    "timestamp": "2026-05-06T22:33:10.715Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.8.0",
+      "bom-ref": "@blamejs/core@0.8.5",
       "type": "library",
       "name": "blamejs",
-      "version": "0.8.0",
+      "version": "0.8.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.8.0",
+      "purl": "pkg:npm/%40blamejs/core@0.8.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.8.0",
+      "ref": "@blamejs/core@0.8.5",
       "dependsOn": []
     }
   ]