Bump sigstore and npm in /website

[dependabot]

Bumps sigstore to 5.0.0 and updates ancestor dependency npm. These dependencies need to be updated together.

Updates sigstore from 2.3.0 to 5.0.0

Release notes

Sourced from sigstore's releases.

sigstore@5.0.0

Major Changes

• 46c00b3: Drop support for Node 20

Patch Changes

• Updated dependencies [7db2666]
• Updated dependencies [74eda7a]
• Updated dependencies [46c00b3]
• Updated dependencies [46c00b3]
• Updated dependencies [46c00b3]
• Updated dependencies [46c00b3]
  • @​sigstore/tuf@​5.0.0
  • @​sigstore/bundle@​5.0.0
  • @​sigstore/verify@​4.0.0
  • @​sigstore/core@​4.0.0
  • @​sigstore/sign@​5.0.0

sigstore@4.1.1

Patch Changes

• 7845532: Verification of OID certificate extensions
• f074710: Require inclusion promise in Rekor entry when used as timestamp source
• Updated dependencies [b5aa4f1]
• Updated dependencies [7845532]
• Updated dependencies [f074710]
  • @​sigstore/core@​3.2.1
  • @​sigstore/verify@​3.1.1

sigstore@4.1.0

Minor Changes

• eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

• Updated dependencies [cee51c0]
• Updated dependencies [2042aad]
• Updated dependencies [018974e]
• Updated dependencies [dea916f]
• Updated dependencies [61a4f9e]
• Updated dependencies [5ffadc0]
• Updated dependencies [5ffadc0]
• Updated dependencies [1663b3e]
  • @​sigstore/tuf@​4.0.1
  • @​sigstore/verify@​3.1.0
  • @​sigstore/sign@​4.1.0
  • @​sigstore/core@​3.1.0

... (truncated)

Commits

• 7d2900e Version Packages (#1661)
• 46c00b3 Drop Node 20 (#1670)
• 3975770 Bump the dev-deps group across 1 directory with 3 updates (#1665)
• 7db2666 Update TUF seed files (#1662)
• ffa2c84 Bump the minor-patch group with 2 updates (#1663)
• 74eda7a update tuf-js to 5.0.1 (#1647)
• c1dc7d4 Version Packages (#1607)
• f074710 reject integratedTime w/o inclusionPromise (#1659)
• 7845532 OID certificate extension verification (#1658)
• b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sigstore since your current version.

Updates npm from 10.5.2 to 12.0.2

Release notes

Sourced from npm's releases.

v12.0.2

12.0.2 (2026-07-27)

Bug Fixes

• 834408e #9760 pack: honor min-release-age-exclude (#9760) (@​martinrrm, @​Copilot)
• ef6cfea #9786 owner: use scoped registry for user lookup (#9786) (@​martinrrm, @​Copilot)

Documentation

• 9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@​Hashim1999164)

Chores

• 7b1f6c1 #9747 parse pack --json object output in node integration (#9747) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

v12.0.1

12.0.1 (2026-07-10)

Bug Fixes

• ecb02a8 #9745 view: avoid wrapping array results (#9745) (@​reggi, @​martinrrm, @​Copilot)
• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@​james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

libnpmpublish: v12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• opts.access now defaults to null instead of 'public'. With null, libnpmpublish no longer sets an explicit access level in the publish payload, so new scoped packages are created as restricted (registry default) and republishes preserve the existing access level. Callers that want to force public access must now pass access: 'public' explicitly.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

v12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.

... (truncated)

Changelog

Sourced from npm's changelog.

12.0.2 (2026-07-27)

Bug Fixes

• 834408e #9760 pack: honor min-release-age-exclude (#9760) (@​martinrrm, @​Copilot)
• ef6cfea #9786 owner: use scoped registry for user lookup (#9786) (@​martinrrm, @​Copilot)

Documentation

• 9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@​Hashim1999164)

Chores

• 7b1f6c1 #9747 parse pack --json object output in node integration (#9747) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

12.0.1 (2026-07-10)

Bug Fixes

• ecb02a8 #9745 view: avoid wrapping array results (#9745) (@​reggi, @​martinrrm, @​Copilot)
• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@​james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.

... (truncated)

Commits

• b888cc9 chore: release 12.0.2
• 834408e fix(pack): honor min-release-age-exclude (#9760)
• ef6cfea fix(owner): use scoped registry for user lookup (#9786)
• 9e17dc0 docs: clarify npm 12 unknown-config breaking change in changelogs (#9805)
• 74eff59 fix(arborist): avoid crash when peer back-off detaches a node (#9770)
• 882d0b2 fix(arborist): allow audit fix to install safe downgrades (#9761)
• 7b1f6c1 chore: parse pack --json object output in node integration (#9747)
• ddd50e9 chore(arborist): add missing registry mock in bin links reify test (#9746)
• 72a6088 chore: release 12.0.1
• ecb02a8 fix(view): avoid wrapping array results (#9745)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by reggi, a new releaser for npm since your current version.