From 347c887e54efe0803f0dae144f91dd5b4b1f73a7 Mon Sep 17 00:00:00 2001
From: Salman Muin Kayser Chishti <salmanmkc@github.com>
Date: Mon, 29 Sep 2025 19:01:19 +0100
Subject: [PATCH] package json

---
 packages/attest/package-lock.json | 66 ++++++++++++++++++-------------
 packages/attest/package.json      | 10 ++---
 2 files changed, 44 insertions(+), 32 deletions(-)

diff --git a/packages/attest/package-lock.json b/packages/attest/package-lock.json
index a0e31f41..a36ea0d5 100644
--- a/packages/attest/package-lock.json
+++ b/packages/attest/package-lock.json
@@ -13,16 +13,16 @@
         "@actions/github": "^6.0.0",
         "@actions/http-client": "^2.2.3",
         "@octokit/plugin-retry": "^6.0.1",
-        "@sigstore/bundle": "^3.0.0",
-        "@sigstore/sign": "^3.0.0",
-        "jose": "^5.2.3"
+        "@sigstore/bundle": "^3.1.0",
+        "@sigstore/sign": "^3.1.0",
+        "jose": "^5.10.0"
       },
       "devDependencies": {
-        "@sigstore/mock": "^0.8.0",
+        "@sigstore/mock": "^0.10.0",
         "@sigstore/rekor-types": "^3.0.0",
         "@types/jsonwebtoken": "^9.0.6",
         "nock": "^13.5.1",
-        "undici": "^5.28.5"
+        "undici": "^6.20.0"
       }
     },
     "node_modules/@actions/core": {
@@ -59,6 +59,18 @@
         "undici": "^5.28.5"
       }
     },
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
     "node_modules/@actions/http-client": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
@@ -69,6 +81,18 @@
         "undici": "^5.25.4"
       }
     },
+    "node_modules/@actions/http-client/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
     "node_modules/@actions/io": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
@@ -547,19 +571,19 @@
       }
     },
     "node_modules/@sigstore/mock": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/@sigstore/mock/-/mock-0.8.0.tgz",
-      "integrity": "sha512-q/ejyYUrfJaO8zecRmfR+nVba5PLyeet3IyoN4W2Wq8ZZ8RiLWA90JelO+MFYexPaslxc0ts/K/lfHrvquQVRQ==",
+      "version": "0.10.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/mock/-/mock-0.10.0.tgz",
+      "integrity": "sha512-FiG4cz9DgmPD80RCcfWmavMaB7LIYw4NXHL/oxdGtOqdKO2zPliJiW9+zhKt3+1W9llbwzTX5WGZG7jlkmxD/A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@peculiar/webcrypto": "^1.5.0",
         "@peculiar/x509": "^1.12.3",
-        "@sigstore/protobuf-specs": "^0.3.2",
+        "@sigstore/protobuf-specs": "^0.4.0",
         "asn1js": "^3.0.5",
         "bytestreamjs": "^2.0.1",
         "canonicalize": "^2.0.0",
-        "jose": "^5.9.4",
+        "jose": "^5.9.6",
         "nock": "^13.5.5",
         "pkijs": "^3.2.4",
         "pvutils": "^1.1.3"
@@ -568,16 +592,6 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/@sigstore/mock/node_modules/@sigstore/protobuf-specs": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.3.3.tgz",
-      "integrity": "sha512-RpacQhBlwpBWd7KEJsRKcBQalbV28fvkxwTOJIqhIuDysMMaJW47V4OqW30iJB9uRpqOSxxEAQFdr8tTattReQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/@sigstore/protobuf-specs": {
       "version": "0.4.3",
       "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.4.3.tgz",
@@ -1611,15 +1625,13 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.21.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.3.tgz",
+      "integrity": "sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
       "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
       }
     },
     "node_modules/undici-types": {
diff --git a/packages/attest/package.json b/packages/attest/package.json
index c2b9781d..ab7db84c 100644
--- a/packages/attest/package.json
+++ b/packages/attest/package.json
@@ -35,20 +35,20 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "devDependencies": {
-    "@sigstore/mock": "^0.8.0",
+    "@sigstore/mock": "^0.10.0",
     "@sigstore/rekor-types": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.6",
     "nock": "^13.5.1",
-    "undici": "^5.28.5"
+    "undici": "^6.20.0"
   },
   "dependencies": {
     "@actions/core": "^1.11.1",
     "@actions/github": "^6.0.0",
     "@actions/http-client": "^2.2.3",
     "@octokit/plugin-retry": "^6.0.1",
-    "@sigstore/bundle": "^3.0.0",
-    "@sigstore/sign": "^3.0.0",
-    "jose": "^5.2.3"
+    "@sigstore/bundle": "^3.1.0",
+    "@sigstore/sign": "^3.1.0",
+    "jose": "^5.10.0"
   },
   "overrides": {
     "@octokit/plugin-retry": {