@sigstore/sign - npm Package Compare versions

Comparing version 4.1.1 to 5.0.0

dist/signer/fulcio/ephemeral.js

@@ -36,3 +36,3 @@ "use strict";
             .export({ format: 'pem', type: 'spki' })
-            .toString('ascii');
+            .toString();
         return {
@@ -39,0 +39,0 @@ signature: signature,

package.json

 {
   "name": "@sigstore/sign",
-  "version": "4.1.1",
+  "version": "5.0.0",
   "description": "Sigstore signing library",
@@ -30,17 +30,17 @@ "main": "dist/index.js",
     "@sigstore/jest": "^0.0.0",
-    "@sigstore/mock": "^0.12.0",
-    "@sigstore/rekor-types": "^4.0.0",
+    "@sigstore/mock": "^0.13.0",
+    "@sigstore/rekor-types": "^5.0.0",
     "@types/make-fetch-happen": "^10.0.4"
   },
   "dependencies": {
-    "@sigstore/bundle": "^4.0.0",
-    "@sigstore/core": "^3.2.0",
+    "@gar/promise-retry": "^1.0.2",
+    "@sigstore/bundle": "^5.0.0",
+    "@sigstore/core": "^4.0.0",
     "@sigstore/protobuf-specs": "^0.5.0",
-    "make-fetch-happen": "^15.0.4",
-    "proc-log": "^6.1.0",
-    "@gar/promise-retry": "^1.0.2"
+    "make-fetch-happen": "^16.0.0",
+    "proc-log": "^7.0.0"
   },
   "engines": {
-    "node": "^20.17.0 || >=22.9.0"
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   }
 }

README.md

@@ -16,3 +16,3 @@ # @sigstore/sign · [![npm version](https://img.shields.io/npm/v/@sigstore/sign.svg?style=flat)](https://www.npmjs.com/package/@sigstore/sign) [![CI Status](https://github.com/sigstore/sigstore-js/workflows/CI/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/ci.yml) [![Smoke Test Status](https://github.com/sigstore/sigstore-js/workflows/smoke-test/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/smoke-test.yml)
 
-- Node.js version ^20.17.0 || >=22.9.0
+- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
 
@@ -19,0 +19,0 @@ ## Installation

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

99830

0.02%

Dependency changes

• + Added

  @npmcli/agent@5.0.2
  (transitive)

• + Added

  @npmcli/fs@6.0.0
  (transitive)

• + Added

  @npmcli/redact@5.0.0
  (transitive)

• + Added

  @sigstore/bundle@5.0.0
  (transitive)

• + Added

  @sigstore/core@4.0.1
  (transitive)

• + Added

  agent-base@9.0.0
  (transitive)

• + Added

  cacache@21.0.1
  (transitive)

• + Added

  http-proxy-agent@9.1.0
  (transitive)

• + Added

  https-proxy-agent@9.1.0
  (transitive)

• + Added

  make-fetch-happen@16.0.1
  (transitive)

• + Added

  minipass-fetch@6.0.0
  (transitive)

• + Added

  proc-log@7.0.0
  (transitive)

• + Added

  proxy-agent-negotiate@1.1.0
  (transitive)

• + Added

  socks-proxy-agent@10.1.0
  (transitive)

• + Added

  ssri@14.0.0
  (transitive)

• - Removed

  @npmcli/agent@4.0.2
  (transitive)

• - Removed

  @npmcli/fs@5.0.0
  (transitive)

• - Removed

  @npmcli/redact@4.0.0
  (transitive)

• - Removed

  @sigstore/bundle@4.0.0
  (transitive)

• - Removed

  @sigstore/core@3.2.1
  (transitive)

• - Removed

  agent-base@7.1.4
  (transitive)

• - Removed

  cacache@20.0.4
  (transitive)

• - Removed

  http-proxy-agent@7.0.2
  (transitive)

• - Removed

  https-proxy-agent@7.0.6
  (transitive)

• - Removed

  make-fetch-happen@15.0.6
  (transitive)

• - Removed

  minipass-fetch@5.0.2
  (transitive)

• - Removed

  proc-log@6.1.0
  (transitive)

• - Removed

  socks-proxy-agent@8.0.5
  (transitive)

• - Removed

  ssri@13.0.1
  (transitive)

• Updated

  @sigstore/bundle@^5.0.0

• Updated

  @sigstore/core@^4.0.0

• Updated

  make-fetch-happen@^16.0.0

• Updated

  proc-log@^7.0.0