Bump sigstore from 4.1.0 to 4.1.1 in /pulumi

[dependabot]

Bumps sigstore from 4.1.0 to 4.1.1.

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

• 7845532: Verification of OID certificate extensions
• f074710: Require inclusion promise in Rekor entry when used as timestamp source
• Updated dependencies [b5aa4f1]
• Updated dependencies [7845532]
• Updated dependencies [f074710]
  • @​sigstore/core@​3.2.1
  • @​sigstore/verify@​3.1.1

Commits

• c1dc7d4 Version Packages (#1607)
• f074710 reject integratedTime w/o inclusionPromise (#1659)
• 7845532 OID certificate extension verification (#1658)
• b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
• c7a34e0 clarify cert ID matching (#1656)
• 9858bd7 Upgrade TypeScript to 6.x (#1655)
• 8cef20d bump qs from 6.15.1 to 6.15.2 (#1654)
• aca341b bump @​sigstore/mock deps (#1653)
• 0855aca Pin all @​swc/core platform binaries as optionalDependencies (#1652)
• 44a374d Pin all @​swc/core platform binaries as optionalDependencies (#1650)
• Additional commits viewable in compare view

[github-actions]

🍹 preview on andymeier/prod

Pulumi report

View in Pulumi Cloud

  Previewing update (prod)

View Live: https://app.pulumi.com/meiermade/andymeier/prod/previews/71270282-de32-4601-8341-3b7c37b9ede5

pulumi:pulumi:Stack: (same)
  [urn=urn:pulumi:prod::andymeier::pulumi:pulumi:Stack::andymeier-prod]
Resources:
  13 unchanged
  

[minniemeierdev]

Reviewed this Dependabot update and I’m comfortable approving it.

Evidence:

• Diff is limited to pulumi/package-lock.json with 17 additions / 17 deletions.
• The lockfile update bumps sigstore from 4.1.0 to 4.1.1, @sigstore/sign from 4.1.0 to 4.1.1, and @sigstore/tuf from 4.0.1 to 4.0.2; no application or Pulumi program source files changed.
• Release notes describe patch-level verification hardening: OID certificate extension verification and requiring an inclusion promise when a Rekor entry is used as a timestamp source, plus related sigstore dependency updates.
• Local validation in /pulumi: npm ci succeeded and npm run check (tsc -p tsconfig.json --noEmit) succeeded.
• npm audit --package-lock-only improves from 23 findings on main to 22 on this branch and removes the prior sigstore finding; no new audit package names appeared.
• GitHub checks are green: Test and Preview both completed successfully.

Recommendation: approve and allow normal merge/automerge; no blockers found.

[dependabot]

Looks like sigstore is up-to-date now, so this is no longer needed.

[minniemeierdev]

Follow-up after the Dependabot rebase banner: I rechecked the current source of truth.

• This PR is now closed by Dependabot as no longer needed; the body no longer contains the rebase banner.
• Head remains 492975879e630376abc8966bc985bbb8d5ce5502, and the diff remains limited to pulumi/package-lock.json.
• The prior approval was attached to that head and still reflects the diff reviewed; Test and Preview were successful on that head.
• The prior merge/automerge recommendation is superseded by the PR being closed. Current main already has sigstore 4.1.1, @sigstore/sign 4.1.1, and @sigstore/tuf 4.0.2 in /pulumi, so no merge action is recommended for this closed PR.