Bump sigstore and @angular/cli by dependabot[bot] · Pull Request #179 · capitalone/acronym-decoder

dependabot · 2026-07-02T11:42:12Z

Bumps sigstore to 4.1.1 and updates ancestor dependency @angular/cli. These dependencies need to be updated together.

Updates sigstore from 3.1.0 to 4.1.1

Release notes

sigstore@4.1.1

Patch Changes

7845532: Verification of OID certificate extensions

f074710: Require inclusion promise in Rekor entry when used as timestamp source

Updated dependencies [b5aa4f1]

Updated dependencies [7845532]

Updated dependencies [f074710]

@sigstore/core@3.2.1

@sigstore/verify@3.1.1

sigstore@4.1.0

Minor Changes

eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

Updated dependencies [cee51c0]

Updated dependencies [2042aad]

Updated dependencies [018974e]

Updated dependencies [dea916f]

Updated dependencies [61a4f9e]

Updated dependencies [5ffadc0]

Updated dependencies [5ffadc0]

Updated dependencies [1663b3e]

@sigstore/tuf@4.0.1

@sigstore/verify@3.1.0

@sigstore/sign@4.1.0

@sigstore/core@3.1.0

sigstore@4.0.0

Major Changes

383e200: Drop support for node 18

Patch Changes

Updated dependencies [40395f5]

Updated dependencies [383e200]

Updated dependencies [383e200]

Updated dependencies [383e200]

@sigstore/tuf@4.0.0

@sigstore/sign@4.0.0

@sigstore/bundle@4.0.0

@sigstore/verify@3.0.0

@sigstore/core@3.0.0

Commits

c1dc7d4 Version Packages (#1607)
f074710 reject integratedTime w/o inclusionPromise (#1659)
7845532 OID certificate extension verification (#1658)
b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
c7a34e0 clarify cert ID matching (#1656)
9858bd7 Upgrade TypeScript to 6.x (#1655)
8cef20d bump qs from 6.15.1 to 6.15.2 (#1654)
aca341b bump @sigstore/mock deps (#1653)
0855aca Pin all @swc/core platform binaries as optionalDependencies (#1652)
44a374d Pin all @swc/core platform binaries as optionalDependencies (#1650)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sigstore since your current version.

Updates @angular/cli from 19.2.19 to 22.0.5

Release notes

Sourced from @angular/cli's releases.

22.0.5

@schematics/angular

Commit Description

remove unused app tsconfig outDir

@angular/cli

Commit Description

gracefully handle package manager errors in command handler

respect release age policy in update bootstrapping logic

@angular-devkit/build-angular

Commit Description

prevent OS command injection in ssr-dev-server builder

@angular/build

Commit Description

auto-inject localize/init in library unit tests

inherit preserveSymlinks option from build target in unit-test builder

load zone.js dynamically for library unit tests

scope createRequire module resolution using paths to prevent parent paths

@angular/ssr

Commit Description

preserve response headers during redirect

22.0.4

@angular/build

Commit Description

aggregate parallel worker performance timings on the main thread

dispose builder result context early in non-watch mode

22.0.3

@schematics/angular

Commit Description

remove default workspace vscode mcp.json configuration

22.0.2

@angular/cli

Commit Description

support registry metadata fetching under bun package manager

implement semaphore backpressure throttling in PackageManager

@angular/build

Commit Description

implement semaphore backpressure throttling in JavaScriptTransformer

@angular/ssr

... (truncated)

Changelog

Sourced from @angular/cli's changelog.

22.0.5 (2026-07-01)

@angular/cli

Commit Type Description

f099e641c fix gracefully handle package manager errors in command handler

cf033ec48 fix respect release age policy in update bootstrapping logic

@schematics/angular

Commit Type Description

862a38069 fix remove unused app tsconfig outDir

@angular-devkit/build-angular

Commit Type Description

f75085f4b fix prevent OS command injection in ssr-dev-server builder

@angular/build

Commit Type Description

dfee1e7b1 fix auto-inject localize/init in library unit tests

aba718403 fix inherit preserveSymlinks option from build target in unit-test builder

7c0d9f03c fix load zone.js dynamically for library unit tests

4288e4452 fix scope createRequire module resolution using paths to prevent parent paths

@angular/ssr

Commit Type Description

5f774f891 fix preserve response headers during redirect

21.2.18 (2026-07-01)

@angular/cli

Commit Type Description

61a810ab6 fix respect release age policy in update bootstrapping logic

@angular/build

... (truncated)

Commits

85a2698 release: cut the v22.0.5 release
5c892ee build: update cross-repo angular dependencies
7848e8d build: lock file maintenance
862a380 fix(@schematics/angular): remove unused app tsconfig outDir
4288e44 fix(@angular/build): scope createRequire module resolution using paths to pre...
5f774f8 fix(@angular/ssr): preserve response headers during redirect
7c0d9f0 fix(@angular/build): load zone.js dynamically for library unit tests
f75085f fix(@angular-devkit/build-angular): prevent OS command injection in ssr-dev-s...
f099e64 fix(@angular/cli): gracefully handle package manager errors in command handler
cf033ec fix(@angular/cli): respect release age policy in update bootstrapping logic
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [sigstore](https://github.com/sigstore/sigstore-js) to 4.1.1 and updates ancestor dependency [@angular/cli](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `sigstore` from 3.1.0 to 4.1.1 - [Release notes](https://github.com/sigstore/sigstore-js/releases) - [Commits](https://github.com/sigstore/sigstore-js/compare/sigstore@3.1.0...sigstore@4.1.1) Updates `@angular/cli` from 19.2.19 to 22.0.5 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@19.2.19...v22.0.5) --- updated-dependencies: - dependency-name: sigstore dependency-version: 4.1.1 dependency-type: indirect - dependency-name: "@angular/cli" dependency-version: 22.0.5 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

CLAassistant · 2026-07-02T11:42:22Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

sonarqubecloud · 2026-07-02T11:42:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

socket-security · 2026-07-02T11:42:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@angular/cli@19.2.19 ⏵ 22.0.5			⁺¹

View full report

socket-security · 2026-07-02T11:42:51Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@schematics/angular` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@angular/cli@22.0.5` → `npm/@schematics/angular@22.0.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@schematics/angular@22.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → `npm/@angular/cli@22.0.5` → `npm/typescript@6.0.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026

dependabot Bot requested a review from a team as a code owner July 2, 2026 11:42

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026

github-actions Bot enabled auto-merge (squash) July 2, 2026 11:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump sigstore and @angular/cli#179

Bump sigstore and @angular/cli#179
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-27a3df8e2d

dependabot Bot commented on behalf of github Jul 2, 2026

Uh oh!

CLAassistant commented Jul 2, 2026

Uh oh!

sonarqubecloud Bot commented Jul 2, 2026

Uh oh!

socket-security Bot commented Jul 2, 2026

Uh oh!

socket-security Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Commit	Description
	gracefully handle package manager errors in command handler
	respect release age policy in update bootstrapping logic

Commit	Description
	auto-inject localize/init in library unit tests
	inherit preserveSymlinks option from build target in unit-test builder
	load zone.js dynamically for library unit tests
	scope createRequire module resolution using paths to prevent parent paths

Commit	Description
	aggregate parallel worker performance timings on the main thread
	dispose builder result context early in non-watch mode

Commit	Description
	support registry metadata fetching under bun package manager
	implement semaphore backpressure throttling in PackageManager

Commit	Type	Description
f099e641c	fix	gracefully handle package manager errors in command handler
cf033ec48	fix	respect release age policy in update bootstrapping logic

Commit	Type	Description
dfee1e7b1	fix	auto-inject localize/init in library unit tests
aba718403	fix	inherit preserveSymlinks option from build target in unit-test builder
7c0d9f03c	fix	load zone.js dynamically for library unit tests
4288e4452	fix	scope createRequire module resolution using paths to prevent parent paths

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 2, 2026

sigstore@4.1.1

Patch Changes

sigstore@4.1.0

Minor Changes

Patch Changes

sigstore@4.0.0

Major Changes

Patch Changes

22.0.5

@​schematics/angular

@​angular/cli

@​angular-devkit/build-angular

@​angular/build

@​angular/ssr

22.0.4

@​angular/build

22.0.3

@​schematics/angular

22.0.2

@​angular/cli

@​angular/build

@​angular/ssr

22.0.5 (2026-07-01)

@​angular/cli

@​schematics/angular

@​angular-devkit/build-angular

@​angular/build

@​angular/ssr

21.2.18 (2026-07-01)

@​angular/cli

@​angular/build

Uh oh!

CLAassistant commented Jul 2, 2026

Uh oh!

sonarqubecloud Bot commented Jul 2, 2026

Quality Gate passed

Uh oh!

socket-security Bot commented Jul 2, 2026

Uh oh!

socket-security Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`@schematics/angular`

`@angular/cli`

`@angular-devkit/build-angular`

`@angular/build`

`@angular/ssr`

`@angular/build`

`@schematics/angular`

`@angular/cli`

`@angular/build`

`@angular/ssr`

`@angular/cli`

`@schematics/angular`

`@angular-devkit/build-angular`

`@angular/build`

`@angular/ssr`

`@angular/cli`

`@angular/build`