deps updates

node_modules/.gitignore

@@ -83,10 +83,6 @@
 !/minipass-collect
 !/minipass-fetch
 !/minipass-flush
-!/minipass-flush/node_modules/
-/minipass-flush/node_modules/*
-!/minipass-flush/node_modules/minipass
-!/minipass-flush/node_modules/yallist
 !/minipass-pipeline
 !/minipass-pipeline/node_modules/
 /minipass-pipeline/node_modules/*

node_modules/@sigstore/protobuf-specs/dist/__generated__/envelope.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: envelope.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Signature = exports.Envelope = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/events.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: events.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CloudEventBatch = exports.CloudEvent_CloudEventAttributeValue = exports.CloudEvent_AttributesEntry = exports.CloudEvent = void 0;
@@ -17,7 +17,7 @@ exports.CloudEvent = {
             specVersion: isSet(object.specVersion) ? globalThis.String(object.specVersion) : "",
             type: isSet(object.type) ? globalThis.String(object.type) : "",
             attributes: isObject(object.attributes)
-                ? Object.entries(object.attributes).reduce((acc, [key, value]) => {
+                ? globalThis.Object.entries(object.attributes).reduce((acc, [key, value]) => {
                     acc[key] = exports.CloudEvent_CloudEventAttributeValue.fromJSON(value);
                     return acc;
                 }, {})
@@ -46,7 +46,7 @@ exports.CloudEvent = {
             obj.type = message.type;
         }
         if (message.attributes) {
-            const entries = Object.entries(message.attributes);
+            const entries = globalThis.Object.entries(message.attributes);
             if (entries.length > 0) {
                 obj.attributes = {};
                 entries.forEach(([k, v]) => {

node_modules/@sigstore/protobuf-specs/dist/__generated__/google/api/field_behavior.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: google/api/field_behavior.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FieldBehavior = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/google/protobuf/any.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: google/protobuf/any.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Any = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/google/protobuf/timestamp.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: google/protobuf/timestamp.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Timestamp = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/dsse.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: rekor/v2/dsse.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DSSELogEntryV002 = exports.DSSERequestV002 = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/entry.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: rekor/v2/entry.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CreateEntryRequest = exports.Spec = exports.Entry = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/hashedrekord.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: rekor/v2/hashedrekord.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HashedRekordLogEntryV002 = exports.HashedRekordRequestV002 = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/verifier.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: rekor/v2/verifier.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Signature = exports.Verifier = exports.PublicKey = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_bundle.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: sigstore_bundle.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Bundle = exports.VerificationMaterial = exports.TimestampVerificationData = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_common.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: sigstore_common.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TimeRange = exports.X509CertificateChain = exports.SubjectAlternativeName = exports.X509Certificate = exports.DistinguishedName = exports.ObjectIdentifierValuePair = exports.ObjectIdentifier = exports.PublicKeyIdentifier = exports.PublicKey = exports.RFC3161SignedTimestamp = exports.LogId = exports.MessageSignature = exports.HashOutput = exports.SubjectAlternativeNameType = exports.PublicKeyDetails = exports.HashAlgorithm = void 0;
@@ -29,7 +29,17 @@ var HashAlgorithm;
     HashAlgorithm[HashAlgorithm["SHA2_256"] = 1] = "SHA2_256";
     HashAlgorithm[HashAlgorithm["SHA2_384"] = 2] = "SHA2_384";
     HashAlgorithm[HashAlgorithm["SHA2_512"] = 3] = "SHA2_512";
+    /**
+     * SHA3_256 - Used for LMS
+     *
+     * @deprecated
+     */
     HashAlgorithm[HashAlgorithm["SHA3_256"] = 4] = "SHA3_256";
+    /**
+     * SHA3_384 - Used for LMS
+     *
+     * @deprecated
+     */
     HashAlgorithm[HashAlgorithm["SHA3_384"] = 5] = "SHA3_384";
 })(HashAlgorithm || (exports.HashAlgorithm = HashAlgorithm = {}));
 function hashAlgorithmFromJSON(object) {
@@ -146,9 +156,7 @@ var PublicKeyDetails;
      * LMS_SHA256 - LMS and LM-OTS
      *
      * These algorithms are deprecated and should not be used.
-     * Keys and signatures MAY be used by private Sigstore
-     * deployments, but will not be supported by the public
-     * good instance.
+     * There are no plans to support SLH-DSA at this time.
      *
      * USER WARNING: LMS and LM-OTS are both stateful signature schemes.
      * Using them correctly requires discretion and careful consideration
@@ -164,20 +172,23 @@ var PublicKeyDetails;
     /** @deprecated */
     PublicKeyDetails[PublicKeyDetails["LMOTS_SHA256"] = 15] = "LMOTS_SHA256";
     /**
-     * ML_DSA_65 - ML-DSA
+     * ML_DSA_44 - ML-DSA
      *
-     * These ML_DSA_65 and ML-DSA_87 algorithms are the pure variants that
-     * take data to sign rather than the prehash variants (HashML-DSA), which
-     * take digests.  While considered quantum-resistant, their usage
+     * These ML_DSA_44, ML_DSA_65 and ML-DSA_87 algorithms are the pure variants
+     * that take data to sign rather than the prehash variants (HashML-DSA), which
+     * take digests. While considered quantum-resistant, their usage
      * involves tradeoffs in that signatures and keys are much larger, and
      * this makes deployments more costly.
      *
-     * USER WARNING: ML_DSA_65 and ML_DSA_87 are experimental algorithms.
+     * USER WARNING: ML_DSA_44, ML_DSA_65 and ML_DSA_87 are experimental algorithms.
      * In the future they MAY be used by private Sigstore deployments, but
-     * they are not yet fully functional.  This warning will be removed when
+     * they are not yet fully functional. This warning will be removed when
      * these algorithms are widely supported by Sigstore clients and servers,
      * but care should still be taken for production environments.
+     *
+     * See NIST FIPS 204, RFC 9881 for algorithm identifiers
      */
+    PublicKeyDetails[PublicKeyDetails["ML_DSA_44"] = 23] = "ML_DSA_44";
     PublicKeyDetails[PublicKeyDetails["ML_DSA_65"] = 21] = "ML_DSA_65";
     PublicKeyDetails[PublicKeyDetails["ML_DSA_87"] = 22] = "ML_DSA_87";
 })(PublicKeyDetails || (exports.PublicKeyDetails = PublicKeyDetails = {}));
@@ -246,6 +257,9 @@ function publicKeyDetailsFromJSON(object) {
         case 15:
         case "LMOTS_SHA256":
             return PublicKeyDetails.LMOTS_SHA256;
+        case 23:
+        case "ML_DSA_44":
+            return PublicKeyDetails.ML_DSA_44;
         case 21:
         case "ML_DSA_65":
             return PublicKeyDetails.ML_DSA_65;
@@ -300,6 +314,8 @@ function publicKeyDetailsToJSON(object) {
             return "LMS_SHA256";
         case PublicKeyDetails.LMOTS_SHA256:
             return "LMOTS_SHA256";
+        case PublicKeyDetails.ML_DSA_44:
+            return "ML_DSA_44";
         case PublicKeyDetails.ML_DSA_65:
             return "ML_DSA_65";
         case PublicKeyDetails.ML_DSA_87:

node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_rekor.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: sigstore_rekor.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TransparencyLogEntry = exports.InclusionPromise = exports.InclusionProof = exports.Checkpoint = exports.KindVersion = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_trustroot.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: sigstore_trustroot.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientTrustConfig = exports.ServiceConfiguration = exports.Service = exports.SigningConfig = exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = exports.ServiceSelector = void 0;

node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_verification.js

@@ -1,8 +1,8 @@
 "use strict";
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.7.5
-//   protoc               v6.30.2
+//   protoc-gen-ts_proto  v2.11.5
+//   protoc               v7.34.1
 // source: sigstore_verification.proto
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Input = exports.Artifact = exports.ArtifactVerificationOptions_ObserverTimestampOptions = exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = exports.ArtifactVerificationOptions_TimestampAuthorityOptions = exports.ArtifactVerificationOptions_CtlogOptions = exports.ArtifactVerificationOptions_TlogOptions = exports.ArtifactVerificationOptions = exports.PublicKeyIdentities = exports.CertificateIdentities = exports.CertificateIdentity = void 0;

node_modules/@sigstore/protobuf-specs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/protobuf-specs",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "code-signing for npm packages",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

node_modules/brace-expansion/dist/commonjs/index.js

@@ -144,7 +144,9 @@ function expand_(str, max, isTop) {
             const x = numeric(n[0]);
             const y = numeric(n[1]);
             const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ? Math.abs(numeric(n[2])) : 1;
+            let incr = n.length === 3 && n[2] !== undefined ?
+                Math.max(Math.abs(numeric(n[2])), 1)
+                : 1;
             let test = lte;
             const reverse = y < x;
             if (reverse) {

node_modules/brace-expansion/dist/esm/index.js

@@ -140,7 +140,9 @@ function expand_(str, max, isTop) {
             const x = numeric(n[0]);
             const y = numeric(n[1]);
             const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ? Math.abs(numeric(n[2])) : 1;
+            let incr = n.length === 3 && n[2] !== undefined ?
+                Math.max(Math.abs(numeric(n[2])), 1)
+                : 1;
             let test = lte;
             const reverse = y < x;
             if (reverse) {

node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.4",
+  "version": "5.0.5",
   "files": [
     "dist"
   ],

node_modules/diff/CONTRIBUTING.md

@@ -19,7 +19,7 @@ A full release may be completed by first updating the `"version"` property in pa
 ```
 yarn clean
 yarn build
-yarn publish
+yarn npm publish
 ```
 
 After releasing, remember to: