CVE-2026-48815 (sigstore via npm) found on node-v22.x-nsolid-v6.x

[github-actions]

A vulnerability for sigstore 3.1.0 was found:
Vulnerability ID: CVE-2026-48815
Vulnerability URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48815
Vulnerability Title: sigstore's certificateOIDs verification constraints are silently dropped and never enforced
Main Dependency: npm
Main Dependency Path: deps/npm
Last seen in run: https://github.com/nodesource/nsolid-dependency-vuln-assessments/actions/runs/32553544342

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• CVE-2026-48815 (sigstore via npm) found on node-v22.x-nsolid-v6.x #1984

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!