Bump @sigstore/core and @npmcli/arborist in /bun/helpers by dependabot[bot] · Pull Request #15454 · dependabot/dependabot-core

dependabot · 2026-06-30T12:42:24Z

Bumps @sigstore/core to 4.0.1 and updates ancestor dependency @npmcli/arborist. These dependencies need to be updated together.

Updates @sigstore/core from 1.1.0 to 4.0.1

Release notes

Sourced from @sigstore/core's releases.

@sigstore/core@4.0.1

Patch Changes

04ea25a: ASN.1 parser hardening

@sigstore/core@4.0.0

Major Changes

46c00b3: Drop support for Node 20

@sigstore/core@3.2.1

Patch Changes

b5aa4f1: Apply UTF-8 encoding to payload type during PAE calculation

@sigstore/core@3.2.0

Minor Changes

8f736ef: Update the createPublicKey function to support base64-encoded keys

@sigstore/core@3.0.0

Major Changes

383e200: Drop support for node 18

@sigstore/core@2.0.0

Major Changes

b78615b: Remove hash function in core package

2e58489: Drop support for node 16

Commits

d406ea6 Version Packages (#1676)
4245d6f Bump the prod-deps group across 1 directory with 11 updates (#1691)
85c5838 Merge commit from fork
a063789 Bump actions/checkout from 6.0.3 to 7.0.0 (#1686)
46a180c Bump the dev-deps group with 3 updates (#1688)
6e64be8 Bump form-data from 4.0.4 to 4.0.6 (#1684)
87ad7f1 Bump the prod-deps group across 1 directory with 12 updates (#1685)
bdaedac Bump the dev-deps group across 1 directory with 5 updates (#1683)
98fac89 Bump the minor-patch group across 1 directory with 2 updates (#1681)
754e2a3 Support DSSE bundles with Rekor v2 hashedrekord entries (#1677)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @sigstore/core since your current version.

Updates @npmcli/arborist from 8.0.0 to 10.0.1

Release notes

Sourced from @npmcli/arborist's releases.

arborist: v10.0.1

10.0.1 (2026-07-10)

Bug Fixes

47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@james-pre)

libnpmpack: v10.0.1

Dependencies

workspace: @npmcli/arborist@10.0.1

arborist: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.

Preserve https protocol when working with git (#8703)

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

5b83698 #9737 trigger release process (#9737) (@reggi)

libnpmpack: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

npm pack and npm publish now error when a package's overrides apply to one or more of its bundled packages (bundledDependencies / bundleDependencies). Defining both fields is still allowed as long as no override actually targets a bundled package. To resolve the error, remove the affected entries from either overrides or the bundle.

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.

Features

5b83698 #9737 trigger release process (#9737) (@reggi)

Dependencies

workspace: @npmcli/arborist@10.0.0

libnpmsearch: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

5b83698 #9737 trigger release process (#9737) (@reggi)

arborist: v10.0.0-pre.2

10.0.0-pre.2 (2026-06-29)

Features

b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)

86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)

c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)

58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk)

Bug Fixes

968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@manzoorwanijk)

ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)

... (truncated)

Changelog

Sourced from @npmcli/arborist's changelog.

10.0.1 (2026-07-10)

Bug Fixes

47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@james-pre)

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.

Preserve https protocol when working with git (#8703)

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

5b83698 #9737 trigger release process (#9737) (@reggi)

10.0.0-pre.2 (2026-06-29)

Features

b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)

86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)

c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)

58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk)

Bug Fixes

968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@manzoorwanijk)

ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)

541c286 #9658 arborist: forward transitive overrides through linked store links (#9658) (@manzoorwanijk)

f9e3a80 #9655 arborist: correct dev/prod dep flags for workspaces under the linked strategy (#9655) (@manzoorwanijk)

6a5bf26 #9654 arborist: load transitive optional deps into linked actual tree (#9654) (@manzoorwanijk)

803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@manzoorwanijk)

60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@JamieMagee)

ca92323 #9647 arborist: clean up stale .store and hoisted dirs on strategy switch (#9647) (@manzoorwanijk)

2b976b5 #9637 arborist: invalid filterNode crash under the linked strategy (#9637) (@manzoorwanijk)

0ffce98 #9628 arborist: repair wrong-but-existing symlink target in linked strategy (#9628) (@manzoorwanijk)

981e249 #9632 arborist: remove stale .bin shims after uninstall under linked (#9632) (@manzoorwanijk)

6968015 #9630 arborist: record the linked .store layout in the hidden lockfile (#9630) (@manzoorwanijk)

2aa1c7c #9605 arborist: validate peerOptional conflicts in no-save mutations (#9605) (@dale-lakes, @dale-lakes)

690bf17 #9603 arborist: fix audit-report determinism due to dropped via links (#9603) (@arjun-vegeta)

851558c #9626 arborist: don't load store packages' devDependencies as required edges (#9626) (@manzoorwanijk)

989f571 #9625 arborist: audit the non-isolated tree under the linked strategy (#9625) (@manzoorwanijk)

7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)

00b9f9f #9591 arborist: symlink workspace file: deps on non-workspace local packages (#9591) (@manzoorwanijk)

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Preserve https protocol when working with git (#8703)

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@manzoorwanijk)

1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@manzoorwanijk)

be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@JamieMagee)

18eb967 #9559 bump to new node engine range (@owlstronaut)

c3e1a71 #9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)

5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)

64e3f79 #9480 allowScripts tooling and inBundle hardening (#9480) (@JamieMagee)

... (truncated)

Commits

a481f57 chore: release 11.0.0
a07f4e0 chore: @npmcli/template-oss@4.23.6
cf52b8b chore: release 11.0.0-pre.1
f3ac7b7 feat!: no implicit latest tag on publish when latest > version (#7939)
c0bcc2a deps: walk-up-path@4.0.0
4bf1901 deps: @npmcli/metavuln-calculator@9.0.0
ca84b22 deps!: pacote@21.0.0
523ad85 chore: release 11.0.0-pre.0
6edfe2f chore: @npmcli/template-oss@4.23.5
6995303 feat!: adds --ignore-scripts flag to pack
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by reggi, a new releaser for @npmcli/arborist since your current version.

Bumps [@sigstore/core](https://github.com/sigstore/sigstore-js) to 4.0.1 and updates ancestor dependency [@npmcli/arborist](https://github.com/npm/cli/tree/HEAD/workspaces/arborist). These dependencies need to be updated together. Updates `@sigstore/core` from 1.1.0 to 4.0.1 - [Release notes](https://github.com/sigstore/sigstore-js/releases) - [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/core@1.1.0...@sigstore/core@4.0.1) Updates `@npmcli/arborist` from 8.0.0 to 10.0.1 - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/latest/workspaces/arborist/CHANGELOG.md) - [Commits](https://github.com/npm/cli/commits/config-v10.0.1/workspaces/arborist) --- updated-dependencies: - dependency-name: "@npmcli/arborist" dependency-version: 9.9.0 dependency-type: direct:production - dependency-name: "@sigstore/core" dependency-version: 3.2.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies javascript Dependabot pull requests that update Javascript code labels Jun 30, 2026

dependabot Bot requested a review from a team as a code owner June 30, 2026 12:42

dependabot Bot added dependencies javascript Dependabot pull requests that update Javascript code labels Jun 30, 2026

github-actions Bot added the L: javascript label Jun 30, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/bun/helpers/multi-1a8b5e3f60 branch 5 times, most recently from b9b4597 to f2e5188 Compare July 21, 2026 21:58

dependabot Bot force-pushed the dependabot/npm_and_yarn/bun/helpers/multi-1a8b5e3f60 branch from f2e5188 to 360bfe6 Compare July 21, 2026 22:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump @sigstore/core and @npmcli/arborist in /bun/helpers#15454

Bump @sigstore/core and @npmcli/arborist in /bun/helpers#15454
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/bun/helpers/multi-1a8b5e3f60

dependabot Bot commented on behalf of github Jun 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​sigstore/core@​4.0.1

Patch Changes

@​sigstore/core@​4.0.0

Major Changes

@​sigstore/core@​3.2.1

Patch Changes

@​sigstore/core@​3.2.0

Minor Changes

@​sigstore/core@​3.0.0

Major Changes

@​sigstore/core@​2.0.0

Major Changes

arborist: v10.0.1

10.0.1 (2026-07-10)

Bug Fixes

libnpmpack: v10.0.1

Dependencies

arborist: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

Features

libnpmpack: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

Features

Dependencies

libnpmsearch: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

Features

arborist: v10.0.0-pre.2

10.0.0-pre.2 (2026-06-29)

Features

Bug Fixes

10.0.1 (2026-07-10)

Bug Fixes

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

Features

10.0.0-pre.2 (2026-06-29)

Features

Bug Fixes

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 30, 2026 •

edited

Loading

`@sigstore/core@4`.0.1

`@sigstore/core@4`.0.0

`@sigstore/core@3`.2.1

`@sigstore/core@3`.2.0

`@sigstore/core@3`.0.0

`@sigstore/core@2`.0.0