Skip to content

build(deps): bump sigstore and ls-engines#922

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-3313064c28
Open

build(deps): bump sigstore and ls-engines#922
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-3313064c28

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 2, 2026

Copy link
Copy Markdown
Contributor

Bumps sigstore to 4.1.1 and updates ancestor dependency ls-engines. These dependencies need to be updated together.

Updates sigstore from 1.9.0 to 4.1.1

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

  • 7845532: Verification of OID certificate extensions
  • f074710: Require inclusion promise in Rekor entry when used as timestamp source
  • Updated dependencies [b5aa4f1]
  • Updated dependencies [7845532]
  • Updated dependencies [f074710]
    • @​sigstore/core@​3.2.1
    • @​sigstore/verify@​3.1.1

sigstore@4.1.0

Minor Changes

  • eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

  • Updated dependencies [cee51c0]
  • Updated dependencies [2042aad]
  • Updated dependencies [018974e]
  • Updated dependencies [dea916f]
  • Updated dependencies [61a4f9e]
  • Updated dependencies [5ffadc0]
  • Updated dependencies [5ffadc0]
  • Updated dependencies [1663b3e]
    • @​sigstore/tuf@​4.0.1
    • @​sigstore/verify@​3.1.0
    • @​sigstore/sign@​4.1.0
    • @​sigstore/core@​3.1.0

sigstore@4.0.0

Major Changes

  • 383e200: Drop support for node 18

Patch Changes

  • Updated dependencies [40395f5]
  • Updated dependencies [383e200]
  • Updated dependencies [383e200]
  • Updated dependencies [383e200]
    • @​sigstore/tuf@​4.0.0
    • @​sigstore/sign@​4.0.0
    • @​sigstore/bundle@​4.0.0
    • @​sigstore/verify@​3.0.0
    • @​sigstore/core@​3.0.0

sigstore@3.1.0

Minor Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sigstore since your current version.


Updates ls-engines from 0.9.4 to 0.10.1

Changelog

Sourced from ls-engines's changelog.

v0.10.1 - 2026-06-19

Commits

  • [New] add types 13ff435
  • [Tests] update fixtures 0b249a1
  • [eslint] some cleanup c5046f7
  • [actions] update workflows 0ceb848
  • [Deps] update pargs 12170a9
  • [Robustness] avoid .push, use void 79e28f2
  • [Dev Deps] update auto-changelog, eslint, npmignore, tape 27c9468
  • [meta] exclude some files from the publish ae9bf18
  • [Refactor] store valid engines in an importable file c2cee45
  • [Fix] use valid subpath imports specifier for node <24 301a113
  • [eslint] fix errors 523e825
  • [Deps] update pargs, semver afa5e63
  • [Tests] update tape 7366498
  • [Dev Deps] update eslint 3c8a241
  • [Deps] update pargs 7c4b17d
  • [readme] replace runkit CI badge with shields.io check-runs badge 46608fe
  • [eslint] fix linting dd08850

v0.10.0 - 2025-12-22

Commits

  • [Dev Deps] update eslint, @ljharb/eslint-config 9bdfde1
  • [Refactor] switch from yargs to pargs 52031da
  • [Refactor] extract fulfilled result processing into separate module 6621295
  • [Deps] remove unused and no-longer-needed deps 04c90fb
  • [Refactor] use util.styleText instead of colors b77a164
  • [Tests] add regression test for --save flag modifying package.json fb74dd9
  • [Refactor] convert CLI entrypoint to ESM f5f4084
  • [Breaking] require node 22 9d4fbbc
  • [Fix] correctly extract save function from fulfilled result value 4d04d3c
  • [Deps] update @npmcli/arborist, json-file-plus, pacote a6f1e0e
  • [Dev Deps] update nyc 1569183
  • [Dev Deps] update npmignore b1342bb
  • [Deps] update json-file-plus fa28493
  • [Deps] update get-dep-tree 53f3cfa
  • [Dev Deps] update @ljharb/eslint-config db2c528
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump sigstore and ls-engines
d1921c9 
Bumps [sigstore](https://github.com/sigstore/sigstore-js) to 4.1.1 and updates ancestor dependency [ls-engines](https://github.com/ljharb/ls-engines). These dependencies need to be updated together.


Updates `sigstore` from 1.9.0 to 4.1.1
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/sigstore@1.9.0...sigstore@4.1.1)

Updates `ls-engines` from 0.9.4 to 0.10.1
- [Changelog](https://github.com/ljharb/ls-engines/blob/main/CHANGELOG.md)
- [Commits](ljharb/ls-engines@v0.9.4...v0.10.1)

---
updated-dependencies:
- dependency-name: sigstore
  dependency-version: 4.1.1
  dependency-type: indirect
- dependency-name: ls-engines
  dependency-version: 0.10.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026
@socket-security

socket-security Bot commented Jul 2, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updateddebug@​4.4.1 ⏵ 4.4.310010010083100
Updatedls-engines@​0.9.4 ⏵ 0.10.192 +11008488 +7100

View full report

@socket-security

socket-security Bot commented Jul 2, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm es-abstract is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/ls-engines@0.10.1 → npm/es-abstract@1.24.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants