@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/packages/workspace/watchlist-store.mjs

@@ -1,13 +1,103 @@
 // Pure browser-local watchlist collection model. Watchlist history owns the
 // evidence shape and diff semantics; this module owns collection names, schema
 // migration, import merging, and exact serialized-byte accounting.
-import { MAX_WATCHLIST_DOMAINS, normalizeWatchlistEntry } from "./watchlist-history.mjs";
+import { MAX_WATCHLIST_DOMAINS, normalizeWatchlistEntry, compactWatchlistResults, appendWatchlistScan, mergeWatchlistBaseline, watchlistActiveDomains, assertWatchlistEditable } from "./watchlist-history.mjs";
+import { mergeWatchDomainMetadata, normalizeWatchDomainMetadata } from "./brand-candidate-workflow.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, WATCHLIST_BROWSER_SUPPORTED_VERSIONS, WATCHLIST_EXPORT_SUPPORTED_VERSIONS, } from "../contracts/workspace-portability.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJson } from "../analysis/bounded-json.mjs";
+import { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, MAX_WATCHLIST_PORTABLE_BYTES, WATCHLIST_RECOVERY_METADATA_BYTES, serialiseWorkspacePortableJson, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, WATCHLIST_BROWSER_SUPPORTED_VERSIONS, WATCHLIST_EXPORT_SUPPORTED_VERSIONS, } from "../contracts/workspace-portability.mjs";
 export { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 const BLOCKED_NAMES = new Set(['__proto__', 'prototype', 'constructor']);
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
+/** Restore evidence while retaining every local active member and its context. */
+export function planHostedWatchlistRestore(current, name, input) {
+    const normalizedName = normalizeWatchlistName(name);
+    if (!normalizedName)
+        throw new Error('Hosted watchlist name is invalid.');
+    const target = resolveWatchlistMutationTarget(normalizeWatchlistStore(current).watchlists, normalizedName);
+    const snapshot = normalizeWatchlistEntry(input);
+    assertWatchlistEditable(snapshot);
+    const before = new Set(target.previous ? watchlistActiveDomains(target.previous) : []);
+    const metadata = normalizeWatchDomainMetadata(target.previous?.domainMetadata, snapshot.results.map(record => record.domain));
+    const after = new Set(metadata.map(record => record.domain));
+    // Check bytes as well as membership before requesting consent.
+    assertWatchlistStoreBudget({ ...current, [target.name]: { ...snapshot, domainMetadata: metadata } });
+    return freezePreview(structuredClone({ name: target.name, previous: target.previous, snapshot,
+        retained: [...before].sort(), added: [...after].filter(domain => !before.has(domain)).sort(),
+        removed: [], capacity: MAX_WATCHLIST_DOMAINS }));
+}
+export function applyReviewedHostedWatchlistRestore(current, reviewed) {
+    const fresh = planHostedWatchlistRestore(current, reviewed.name, reviewed.snapshot);
+    if (JSON.stringify(fresh) !== JSON.stringify(reviewed))
+        throw new Error('The watchlist changed after review. Preview its membership again; nothing was overwritten.');
+    return assertWatchlistStoreBudget({ ...current, [fresh.name]: { ...fresh.snapshot,
+            domainMetadata: normalizeWatchDomainMetadata(fresh.previous?.domainMetadata, fresh.snapshot.results.map(record => record.domain)) } }).watchlists;
+}
+export function resolveWatchlistMutationTarget(current, requestedName) {
+    const existingName = Object.keys(current).find(candidate => candidate.toLowerCase() === requestedName.toLowerCase());
+    const previous = existingName ? current[existingName] ?? null : null;
+    assertWatchlistEditable(previous);
+    if (!previous && Object.keys(current).length >= MAX_WATCHLISTS)
+        throw new Error('Watchlist storage is full. Export and remove a watchlist before saving more.');
+    return { name: existingName || requestedName, previous };
+}
+function freezePreview(value) {
+    if (value && typeof value === 'object') {
+        for (const child of Object.values(value))
+            freezePreview(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+/** Review current membership and the exact compact submitted evidence together. */
+export function planWatchlistUpdate(current, name, input, mode, operation) {
+    const normalizedName = normalizeWatchlistName(name);
+    if (!normalizedName)
+        throw new Error('Watchlist names must be 1–100 characters and use a safe name.');
+    if (!Array.isArray(input) || input.length > MAX_WATCHLIST_DOMAINS)
+        throw new Error(`Watchlists are limited to ${MAX_WATCHLIST_DOMAINS} domains.`);
+    if (!['fast', 'deep'].includes(mode) || !['merge', 'replace'].includes(operation))
+        throw new Error('Choose a supported Monitor update operation.');
+    const target = resolveWatchlistMutationTarget(normalizeWatchlistStore(current).watchlists, normalizedName);
+    const submitted = compactWatchlistResults(input);
+    if (!submitted.length || submitted.length !== input.length)
+        throw new Error('The selected Monitor results contain invalid or repeated domains. Nothing was saved.');
+    const before = new Set(target.previous ? watchlistActiveDomains(target.previous) : []);
+    const after = new Set([...(operation === 'merge' ? before : []), ...submitted.map(record => record.domain)]);
+    if (after.size > MAX_WATCHLIST_DOMAINS)
+        throw new Error(`The merged watchlist exceeds its ${MAX_WATCHLIST_DOMAINS}-domain limit. Existing members were preserved.`);
+    return freezePreview(structuredClone({ name: target.name, operation, mode, previous: target.previous, input: submitted,
+        retained: [...before].filter(domain => after.has(domain)).sort(),
+        added: [...after].filter(domain => !before.has(domain)).sort(),
+        removed: [...before].filter(domain => !after.has(domain)).sort() }));
+}
+/** Reconcile consent inside the transaction, then retain only bounded history. */
+export function applyReviewedWatchlistUpdate(current, reviewed, checkedAt = new Date().toISOString()) {
+    const fresh = planWatchlistUpdate(current, reviewed.name, reviewed.input, reviewed.mode, reviewed.operation);
+    if (JSON.stringify(fresh) !== JSON.stringify(reviewed))
+        throw new Error('The watchlist changed after review. Preview its membership again; nothing was overwritten.');
+    // An explicit replacement removes active membership, not retained history.
+    const selected = new Set(fresh.input.map(record => record.domain));
+    const previous = fresh.operation === 'replace' && fresh.previous
+        ? { ...fresh.previous, results: fresh.previous.results.filter(record => selected.has(record.domain)),
+            domainMetadata: fresh.previous.domainMetadata.filter(record => selected.has(record.domain)) }
+        : fresh.previous;
+    const appended = appendWatchlistScan(previous, fresh.input, { mode: fresh.mode, checkedAt });
+    let entry = appended.entry;
+    if (fresh.operation === 'merge' && fresh.previous) {
+        const records = new Map(fresh.previous.results.map(record => [record.domain, record]));
+        for (const record of fresh.input)
+            records.set(record.domain, record);
+        const results = [...records.values()];
+        entry = normalizeWatchlistEntry({ ...entry, results,
+            baseline: mergeWatchlistBaseline(fresh.previous.baseline, results),
+            domainMetadata: fresh.previous.domainMetadata });
+    }
+    const all = { ...current };
+    Object.defineProperty(all, fresh.name, { value: entry, enumerable: true, writable: true, configurable: true });
+    return { watchlists: assertWatchlistStoreBudget(all).watchlists, changes: appended.changes };
+}
 function plainRecord(value) {
     return ordinaryWorkspaceRecord(value, 'Watchlist input');
 }
@@ -40,6 +130,19 @@ function defineEntry(target, name, entry) {
     Object.defineProperty(target, name, { value: entry, writable: true, enumerable: true, configurable: true });
 }
 function assertHistoricalQuality(entry, version) {
+    if (version !== null && version < 6 && Object.hasOwn(entry, 'membershipRecovery'))
+        throw new TypeError('Watchlist membership recovery requires schema 6.');
+    if (version !== null && version < 5 && Object.hasOwn(entry, 'domainMetadata')) {
+        throw new TypeError('Domain watch metadata requires Watchlist schema 5; historical evidence was not reinterpreted.');
+    }
+    if (version !== null && version < 5) {
+        const values = [entry.results, entry.baseline, ...((Array.isArray(entry.history) ? entry.history : []).map(event => plainRecord(event)?.changes))];
+        if (values.some(rows => Array.isArray(rows) && rows.some(value => {
+            const row = plainRecord(value);
+            return row && (Object.hasOwn(row, 'hasExternalPasswordForm') || row.field === 'hasExternalPasswordForm');
+        })))
+            throw new TypeError('Password-form attribution requires Watchlist schema 5; historical evidence was not reinterpreted.');
+    }
     if (version !== 2)
         return;
     for (const values of [entry.results, entry.baseline]) {
@@ -66,7 +169,7 @@ export function normalizeWatchlistStore(raw) {
         if (!name || !entry || !Array.isArray(entry.results) || entry.results.length > MAX_WATCHLIST_DOMAINS)
             continue;
         assertHistoricalQuality(entry, root?.schema === WATCHLIST_SCHEMA ? watchlistStoreVersion(root) : null);
-        defineEntry(watchlists, name, normalizeWatchlistEntry(entry));
+        defineEntry(watchlists, name, normalizeWatchlistEntry(entry, { recoverLegacyMembership: root?.schema === WATCHLIST_SCHEMA && root.version === 5 }));
         if (Object.keys(watchlists).length >= MAX_WATCHLISTS)
             break;
     }
@@ -77,7 +180,8 @@ function byteLength(value) {
 }
 export function assertWatchlistStoreBudget(watchlists) {
     const store = normalizeWatchlistStore(watchlists);
-    if (byteLength(JSON.stringify(store)) > MAX_WATCHLIST_STORE_BYTES) {
+    const recoveryBytes = Object.values(store.watchlists).filter(entry => entry.membershipRecovery).length * WATCHLIST_RECOVERY_METADATA_BYTES;
+    if (byteLength(JSON.stringify(store)) - recoveryBytes > MAX_WATCHLIST_STORE_BYTES) {
         throw new Error('Watchlist storage is full. Export and remove a watchlist before saving more.');
     }
     return store;
@@ -120,13 +224,28 @@ export function mergeWatchlistStores(localRaw, importedRaw) {
             continue;
         }
         assertHistoricalQuality(entry, importedVersion);
-        const normalized = normalizeWatchlistEntry(entry);
+        const normalized = normalizeWatchlistEntry(entry, { recoverLegacyMembership: importedVersion === 5 });
         if (Object.prototype.hasOwnProperty.call(local, name)) {
+            if (normalized.membershipRecovery || local[name].membershipRecovery) {
+                if (JSON.stringify(normalized) === JSON.stringify(local[name])) {
+                    skipped++;
+                    continue;
+                }
+                throw new Error('A watchlist awaiting membership recovery cannot be merged or replaced. Import it under a separate name to preserve both records.');
+            }
             const localTime = local[name].updatedAt;
+            const previous = local[name];
+            const domainMetadata = mergeWatchDomainMetadata(previous.domainMetadata, Object.hasOwn(entry, 'domainMetadata') ? normalized.domainMetadata : []);
             if (!normalized.updatedAt || !localTime || normalized.updatedAt <= localTime) {
-                skipped++;
+                if (JSON.stringify(domainMetadata) !== JSON.stringify(previous.domainMetadata)) {
+                    defineEntry(local, name, { ...previous, domainMetadata });
+                    updated++;
+                }
+                else
+                    skipped++;
                 continue;
             }
+            normalized.domainMetadata = domainMetadata;
             updated++;
         }
         else if (Object.keys(local).length >= MAX_WATCHLISTS) {
@@ -147,6 +266,16 @@ export function buildWatchlistExport(watchlists, nowIso = new Date().toISOString
         schema: WATCHLIST_SCHEMA,
         version: WATCHLIST_SCHEMA_VERSION,
         exportedAt,
-        watchlists: normalizeWatchlistStore(watchlists).watchlists,
+        watchlists: assertWatchlistStoreBudget(watchlists).watchlists,
     };
 }
+/** Preserve readable formatting when it fits; maximum stores need compact JSON. */
+export function serializeWatchlistExport(watchlists, nowIso) {
+    const value = buildWatchlistExport(watchlists, nowIso);
+    const formatted = serialiseWorkspacePortableJson(value);
+    return byteLength(formatted) <= MAX_WATCHLIST_PORTABLE_BYTES ? formatted : JSON.stringify(value);
+}
+export function parseWatchlistExport(json) {
+    return parseBoundedJson(json, { label: 'Watchlist import', maximumBytes: MAX_WATCHLIST_PORTABLE_BYTES,
+        limits: boundedJsonLimitsForBytes(MAX_WATCHLIST_PORTABLE_BYTES) });
+}

package/third-party-notices.txt

@@ -7,7 +7,7 @@ The inventory is the exact transitive closure of the packaged runtime dependenci
 Package count: 49
 
 ================================================================================
-@napi-rs/canvas@1.0.9
+@napi-rs/canvas@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -34,77 +34,77 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@napi-rs/canvas-android-arm64@1.0.9
+@napi-rs/canvas-android-arm64@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-darwin-arm64@1.0.9
+@napi-rs/canvas-darwin-arm64@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-darwin-x64@1.0.9
+@napi-rs/canvas-darwin-x64@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-arm-gnueabihf@1.0.9
+@napi-rs/canvas-linux-arm-gnueabihf@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-arm64-gnu@1.0.9
+@napi-rs/canvas-linux-arm64-gnu@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-arm64-musl@1.0.9
+@napi-rs/canvas-linux-arm64-musl@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-riscv64-gnu@1.0.9
+@napi-rs/canvas-linux-riscv64-gnu@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-x64-gnu@1.0.9
+@napi-rs/canvas-linux-x64-gnu@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-x64-musl@1.0.9
+@napi-rs/canvas-linux-x64-musl@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-win32-arm64-msvc@1.0.9
+@napi-rs/canvas-win32-arm64-msvc@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-win32-x64-msvc@1.0.9
+@napi-rs/canvas-win32-x64-msvc@1.0.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
@@ -138,7 +138,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-asym-key@2.9.5
+@peculiar/asn1-asym-key@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -165,7 +165,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-cms@2.9.5
+@peculiar/asn1-cms@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -192,7 +192,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-csr@2.9.5
+@peculiar/asn1-csr@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -219,7 +219,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-ecc@2.9.5
+@peculiar/asn1-ecc@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -246,7 +246,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pfx@2.9.5
+@peculiar/asn1-pfx@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -273,7 +273,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pkcs8@2.9.5
+@peculiar/asn1-pkcs8@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -300,7 +300,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pkcs9@2.9.5
+@peculiar/asn1-pkcs9@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -327,7 +327,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-rsa@2.9.5
+@peculiar/asn1-rsa@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -354,7 +354,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-schema@2.9.5
+@peculiar/asn1-schema@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -381,7 +381,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509@2.9.5
+@peculiar/asn1-x509@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -408,7 +408,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509-attr@2.9.5
+@peculiar/asn1-x509-attr@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -435,7 +435,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509-post-quantum@2.9.5
+@peculiar/asn1-x509-post-quantum@2.10.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -727,7 +727,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ================================================================================
-pdfjs-dist@6.3.289
+pdfjs-dist@6.4.299
 Relationship: direct production dependency
 Declared licence: Apache-2.0
 Licence source: LICENSE
@@ -909,7 +909,7 @@ Apache License
 
    END OF TERMS AND CONDITIONS
 ================================================================================
-postal-mime@3.0.0
+postal-mime@4.0.4
 Relationship: direct production dependency
 Declared licence: MIT-0
 Licence source: LICENSE.txt
@@ -1148,7 +1148,7 @@ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ================================================================================
-tldts@7.4.14
+tldts@7.4.16
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -1167,7 +1167,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ================================================================================
-tldts-core@7.4.14
+tldts-core@7.4.16
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -1249,7 +1249,7 @@ MIT License
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE
 ================================================================================
-undici@8.11.0
+undici@8.11.2
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE