@yanglaofish/fishtools 0.5.2 → 0.5.3

package/node_modules/@npmcli/package-json/lib/normalize.js

@@ -133,7 +133,7 @@ function secureAndUnixifyPath (ref) {
   return secured.startsWith('./') ? '' : secured
 }
 
-// Only steps that can be ran synchronously. There are some object constructors (i.e. Aborist Node) that need synchronous normalization so here we are.
+// Only steps that can be ran synchronously.  There are some object constructors (i.e. Aborist Node) that need synchronous normalization so here we are.
 function syncSteps (pkg, { strict, steps, changes, allowLegacyCase }) {
   const data = pkg.content
   const pkgId = `${data.name ?? ''}@${data.version ?? ''}`
@@ -237,23 +237,10 @@ function syncSteps (pkg, { strict, steps, changes, allowLegacyCase }) {
     }
   }
 
-  // normalize the shape of the top-level "overrides" field after this step it is either absent or a non-empty object, so consumers do not need to defensively check the type/size
-  if (steps.includes('overrides')) {
-    const ov = data.overrides
-    if (ov !== undefined) {
-      const isObject = ov && typeof ov === 'object' && !Array.isArray(ov)
-      if (!isObject) {
-        changes?.push(`"overrides" was removed (must be an object)`)
-        delete data.overrides
-      } else if (Object.keys(ov).length === 0) {
-        changes?.push(`Empty "overrides" was removed`)
-        delete data.overrides
-      }
-    }
-  }
-
-  // It was once common practice to list deps both in optionalDependencies and in dependencies, to support npm versions that did not know about optionalDependencies.
-  // This is no longer a relevant need, so duplicating the deps in two places is unnecessary and excessive.
+  // it was once common practice to list deps both in optionalDependencies and
+  // in dependencies, to support npm versions that did not know about
+  // optionalDependencies.  This is no longer a relevant need, so duplicating
+  // the deps in two places is unnecessary and excessive.
   if (steps.includes('optionalDedupe')) {
     if (data.dependencies &&
       data.optionalDependencies && typeof data.optionalDependencies === 'object') {
@@ -361,7 +348,8 @@ function syncSteps (pkg, { strict, steps, changes, allowLegacyCase }) {
         }
       }
     }
-    // normalize-package-data used to put optional dependencies BACK into dependencies here, we no longer do this
+    // normalize-package-data used to put optional dependencies BACK into
+    // dependencies here, we no longer do this
 
     for (const deps of ['dependencies', 'devDependencies']) {
       if (deps in data) {
@@ -413,6 +401,18 @@ async function asyncSteps (pkg, { steps, root, changes }) {
     }
   }
 
+  // add "start" attribute if "server.js" exists
+  if (steps.includes('serverjs') && !scripts.start) {
+    try {
+      await fs.access(path.join(pkg.path, 'server.js'))
+      scripts.start = 'node server.js'
+      data.scripts = scripts
+      changes?.push('"scripts.start" was set to "node server.js"')
+    } catch {
+      // do nothing
+    }
+  }
+
   // populate "authors" attribute
   if (steps.includes('authors') && !data.contributors) {
     try {
@@ -583,8 +583,8 @@ async function asyncSteps (pkg, { steps, root, changes }) {
     }
   }
 
-  // Warn if the bin references don't point to anything.
-  // This might be better in normalize-package-data if it had access to the file path.
+  // Warn if the bin references don't point to anything.  This might be better
+  // in normalize-package-data if it had access to the file path.
   if (steps.includes('binRefs') && data.bin instanceof Object) {
     for (const key in data.bin) {
       try {
@@ -597,8 +597,7 @@ async function asyncSteps (pkg, { steps, root, changes }) {
   }
 }
 
-// We don't want the `changes` array in here by default because this is a hot path for parsing packuments during install.
-// The calling method passes it in if it wants to track changes.
+// We don't want the `changes` array in here by default because this is a hot path for parsing packuments during install.  The calling method passes it in if it wants to track changes.
 async function normalize (pkg, opts) {
   if (!pkg.content) {
     throw new Error('Can not normalize without content')

package/node_modules/@npmcli/package-json/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/package-json",
-  "version": "8.0.0",
+  "version": "7.0.5",
   "description": "Programmatic API to update package.json",
   "keywords": [
     "npm",
@@ -29,27 +29,26 @@
     "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "dependencies": {
-    "@npmcli/git": "^8.0.0",
+    "@npmcli/git": "^7.0.0",
     "glob": "^13.0.0",
-    "hosted-git-info": "^10.1.1",
-    "json-parse-even-better-errors": "^6.0.0",
-    "proc-log": "^7.0.0",
+    "hosted-git-info": "^9.0.0",
+    "json-parse-even-better-errors": "^5.0.0",
+    "proc-log": "^6.0.0",
     "semver": "^7.5.3",
     "spdx-expression-parse": "^4.0.0"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/template-oss": "4.28.1",
     "tap": "^16.0.1"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
-    "publish": "true",
-    "updateNpm": false
+    "version": "4.28.1",
+    "publish": "true"
   },
   "tap": {
     "nyc-arg": [

package/node_modules/@npmcli/promise-spawn/README.md

@@ -52,7 +52,8 @@ spawned process.
 - `stdioString` Boolean, default `true`.  Return stdout/stderr output as
   strings rather than buffers.
 - `cwd` String, default `process.cwd()`.  Current working directory for
-  running the script.
+  running the script.  Also the argument to `infer-owner` to determine
+  effective uid/gid when run as root on Unix systems.
 - `shell` Boolean or String. If false, no shell is used during spawn. If true,
   the system default shell is used. If a String, that specific shell is used.
   When a shell is used, the given command runs from within that shell by

package/node_modules/@npmcli/promise-spawn/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/promise-spawn",
-  "version": "10.0.0",
+  "version": "9.0.1",
   "files": [
     "bin/",
     "lib/"
@@ -33,19 +33,19 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/template-oss": "4.28.0",
     "spawk": "^1.7.1",
     "tap": "^16.0.1"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "4.28.0",
     "publish": true
   },
   "dependencies": {
-    "which": "^7.0.0"
+    "which": "^6.0.0"
   }
 }

package/node_modules/@npmcli/redact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/redact",
-  "version": "5.0.0",
+  "version": "4.0.0",
   "description": "Redact sensitive npm information from output",
   "main": "lib/index.js",
   "exports": {
@@ -31,7 +31,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.0.0",
+    "version": "4.27.1",
     "publish": true
   },
   "tap": {
@@ -43,10 +43,10 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "5.0.0",
+    "@npmcli/template-oss": "4.27.1",
     "tap": "^16.3.10"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   }
 }

package/node_modules/@npmcli/run-script/lib/is-server-package.js

@@ -0,0 +1,11 @@
+const { stat } = require('node:fs/promises')
+const { resolve } = require('node:path')
+
+module.exports = async path => {
+  try {
+    const st = await stat(resolve(path, 'server.js'))
+    return st.isFile()
+  } catch (er) {
+    return false
+  }
+}

package/node_modules/@npmcli/run-script/lib/make-spawn-args.js

@@ -1,7 +1,8 @@
+/* eslint camelcase: "off" */
 const setPATH = require('./set-path.js')
 const { resolve } = require('path')
 
-let npmConfigNodeGyp
+let npm_config_node_gyp
 
 const makeSpawnArgs = options => {
   const {
@@ -19,13 +20,13 @@ const makeSpawnArgs = options => {
 
   if (nodeGyp) {
     // npm already pulled this from env and passes it in to options
-    npmConfigNodeGyp = nodeGyp
+    npm_config_node_gyp = nodeGyp
   } else if (env.npm_config_node_gyp) {
     // legacy mode for standalone user
-    npmConfigNodeGyp = env.npm_config_node_gyp
+    npm_config_node_gyp = env.npm_config_node_gyp
   } else {
     // default
-    npmConfigNodeGyp = require.resolve('node-gyp/bin/node-gyp.js')
+    npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
   }
 
   const spawnEnv = setPATH(path, binPaths, {
@@ -35,7 +36,7 @@ const makeSpawnArgs = options => {
     npm_package_json: resolve(path, 'package.json'),
     npm_lifecycle_event: event,
     npm_lifecycle_script: cmd,
-    npm_config_node_gyp: npmConfigNodeGyp,
+    npm_config_node_gyp,
   })
 
   const spawnOpts = {

package/node_modules/@npmcli/run-script/lib/run-script-pkg.js

@@ -3,6 +3,7 @@ const promiseSpawn = require('@npmcli/promise-spawn')
 const packageEnvs = require('./package-envs.js')
 const { isNodeGypPackage, defaultGypInstallScript } = require('@npmcli/node-gyp')
 const signalManager = require('./signal-manager.js')
+const isServerPackage = require('./is-server-package.js')
 
 const runScriptPkg = async options => {
   const {
@@ -36,6 +37,8 @@ const runScriptPkg = async options => {
     await isNodeGypPackage(path)
   ) {
     cmd = defaultGypInstallScript
+  } else if (event === 'start' && await isServerPackage(path)) {
+    cmd = 'node server.js'
   }
 
   if (!cmd) {
@@ -44,13 +47,19 @@ const runScriptPkg = async options => {
 
   let inputEnd = () => {}
   if (stdio === 'inherit') {
-    const { log, input } = require('proc-log')
+    let banner
     if (pkg._id) {
-      log.notice('run', `${pkg._id} ${event}`)
+      banner = `\n> ${pkg._id} ${event}\n`
     } else {
-      log.notice('run', event)
+      banner = `\n> ${event}\n`
     }
-    log.notice('run', `${cmd.trim()} ${args?.join(' ')}`.trim())
+    banner += `> ${cmd.trim().replace(/\n/g, '\n> ')}`
+    if (args.length) {
+      banner += ` ${args.join(' ')}`
+    }
+    banner += '\n'
+    const { output, input } = require('proc-log')
+    output.standard(banner)
     inputEnd = input.start()
   }
 

package/node_modules/@npmcli/run-script/lib/run-script.js

@@ -1,6 +1,7 @@
 const PackageJson = require('@npmcli/package-json')
 const runScriptPkg = require('./run-script-pkg.js')
 const validateOptions = require('./validate-options.js')
+const isServerPackage = require('./is-server-package.js')
 
 const runScript = async options => {
   validateOptions(options)
@@ -11,4 +12,4 @@ const runScript = async options => {
   return runScriptPkg({ ...options, pkg })
 }
 
-module.exports = runScript
+module.exports = Object.assign(runScript, { isServerPackage })

package/node_modules/@npmcli/run-script/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/run-script",
-  "version": "11.0.0",
+  "version": "10.0.4",
   "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
   "author": "GitHub Inc.",
   "license": "ISC",
@@ -15,17 +15,17 @@
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/template-oss": "4.29.0",
     "spawk": "^1.8.1",
     "tap": "^16.0.1"
   },
   "dependencies": {
-    "@npmcli/node-gyp": "^6.0.0",
-    "@npmcli/package-json": "^8.0.0",
-    "@npmcli/promise-spawn": "^10.0.0",
-    "node-gyp": "^13.0.0",
-    "proc-log": "^7.0.0"
+    "@npmcli/node-gyp": "^5.0.0",
+    "@npmcli/package-json": "^7.0.0",
+    "@npmcli/promise-spawn": "^9.0.0",
+    "node-gyp": "^12.1.0",
+    "proc-log": "^6.0.0"
   },
   "files": [
     "bin/",
@@ -37,13 +37,12 @@
     "url": "git+https://github.com/npm/run-script.git"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
-    "publish": "true",
-    "updateNpm": false
+    "version": "4.29.0",
+    "publish": "true"
   },
   "tap": {
     "nyc-arg": [

package/node_modules/@sigstore/bundle/README.md

@@ -10,7 +10,7 @@ A JavaScript library for working with the Sigstore bundle format.
 
 ## Prerequisites
 
-- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
+- Node.js version ^20.17.0 || >=22.9.0
 
 ## Installation
 

package/node_modules/@sigstore/bundle/dist/error.js

@@ -17,7 +17,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 class ValidationError extends Error {
-    fields;
     constructor(message, fields) {
         super(message);
         this.fields = fields;

package/node_modules/@sigstore/bundle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/bundle",
-  "version": "5.0.0",
+  "version": "4.0.0",
   "description": "Sigstore bundle type",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -30,6 +30,6 @@
     "@sigstore/protobuf-specs": "^0.5.0"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   }
 }

package/node_modules/@sigstore/core/README.md

@@ -4,7 +4,7 @@ Base library for [Sigstore][1] JavaScript packages.
 
 ## Prerequisites
 
-- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
+- Node.js version ^20.17.0 || >=22.9.0
 
 
 [1]: https://www.sigstore.dev

package/node_modules/@sigstore/core/dist/asn1/length.js

@@ -37,23 +37,12 @@ function decodeLength(stream) {
     // Iterate over the bytes that encode the length.
     let len = 0;
     for (let i = 0; i < byteCount; i++) {
-        const byte = stream.getUint8();
-        // The first byte of a multi-byte length must not be zero; a leading zero
-        // means the length could have been encoded in fewer bytes (non-minimal).
-        if (i === 0 && byte === 0x00) {
-            throw new error_1.ASN1ParseError('non-minimal length encoding');
-        }
-        len = len * 256 + byte;
+        len = len * 256 + stream.getUint8();
     }
     // This is a valid ASN.1 length encoding, but we don't support it.
     if (len === 0) {
         throw new error_1.ASN1ParseError('indefinite length encoding not supported');
     }
-    // Lengths less than 128 must use the short form; rejecting them here ensures
-    // the encoding is minimal (strict DER).
-    if (len < 128) {
-        throw new error_1.ASN1ParseError('non-minimal length encoding');
-    }
     return len;
 }
 // Translates the supplied value to a DER-encoded length.

package/node_modules/@sigstore/core/dist/asn1/obj.js

@@ -32,14 +32,7 @@ class ASN1Obj {
     }
     // Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
     static parseBuffer(buf) {
-        const stream = new stream_1.ByteStream(buf);
-        const obj = parseStream(stream);
-        // Ensure the entire buffer was consumed; trailing data after the top-level
-        // object indicates a malformed (or maliciously padded) encoding.
-        if (stream.position !== stream.length) {
-            throw new error_1.ASN1ParseError('invalid trailing data');
-        }
-        return obj;
+        return parseStream(new stream_1.ByteStream(buf));
     }
     toDER() {
         const valueStream = new stream_1.ByteStream();
@@ -110,14 +103,7 @@ class ASN1Obj {
 exports.ASN1Obj = ASN1Obj;
 /////////////////////////////////////////////////////////////////////////////
 // Internal stream parsing functions
-// Maximum nesting depth for parsed ASN.1 objects. Bounds the mutual recursion
-// between parseStream and collectSubs so that deeply nested DER cannot exhaust
-// the call stack (denial of service).
-const MAX_DEPTH = 100;
-function parseStream(stream, depth = 0) {
-    if (depth > MAX_DEPTH) {
-        throw new error_1.ASN1ParseError('maximum nesting depth exceeded');
-    }
+function parseStream(stream) {
     // Parse tag, length, and value from stream
     const tag = new tag_1.ASN1Tag(stream.getUint8());
     const len = (0, length_1.decodeLength)(stream);
@@ -128,17 +114,13 @@ function parseStream(stream, depth = 0) {
     // are embedded in OCTESTRING objects, so we need to check those
     // for children as well.
     if (tag.constructed) {
-        subs = collectSubs(stream, len, depth);
+        subs = collectSubs(stream, len);
     }
     else if (tag.isOctetString()) {
         // Attempt to parse children of OCTETSTRING objects. If anything fails,
-        // assume the object is not constructed and treat as primitive. This is
-        // intentional: it transparently unwraps DER content embedded in an OCTET
-        // STRING (e.g. X.509 extnValue, CMS eContent). The error is swallowed
-        // because a parse failure simply means the bytes are an opaque primitive
-        // value rather than a nested structure.
+        // assume the object is not constructed and treat as primitive.
         try {
-            subs = collectSubs(stream, len, depth);
+            subs = collectSubs(stream, len);
         }
         catch (e) {
             // Fail silently and treat as primitive
@@ -150,7 +132,7 @@ function parseStream(stream, depth = 0) {
     }
     return new ASN1Obj(tag, value, subs);
 }
-function collectSubs(stream, len, depth) {
+function collectSubs(stream, len) {
     // Calculate end of object content
     const end = stream.position + len;
     // Make sure there are enough bytes left in the stream. This should never
@@ -163,7 +145,7 @@ function collectSubs(stream, len, depth) {
     // Parse all children
     const subs = [];
     while (stream.position < end) {
-        subs.push(parseStream(stream, depth + 1));
+        subs.push(parseStream(stream));
     }
     // When we're done parsing children, we should be at the end of the object
     if (stream.position !== end) {

package/node_modules/@sigstore/core/dist/asn1/parse.js

@@ -21,7 +21,6 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-const error_1 = require("./error");
 const RE_TIME_SHORT_YEAR = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
 const RE_TIME_LONG_YEAR = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
 // Parse a BigInt from the DER-encoded buffer
@@ -84,18 +83,16 @@ function parseOID(buf) {
     const first = Math.floor(n / 40);
     const second = n % 40;
     let oid = `${first}.${second}`;
-    // Consume remaining bytes. Use a BigInt accumulator so that arcs which
-    // exceed 32 bits are not silently truncated (a truncated arc could be made
-    // to collide with a trusted OID).
-    let val = 0n;
+    // Consume remaining bytes
+    let val = 0;
     for (; pos < end; ++pos) {
         n = buf[pos];
-        val = (val << 7n) + BigInt(n & 0x7f);
+        val = (val << 7) + (n & 0x7f);
         // If the left-most bit is NOT set, then this is the last byte in the
         // sequence and we can add the value to the OID and reset the accumulator
         if ((n & 0x80) === 0) {
             oid += `.${val}`;
-            val = 0n;
+            val = 0;
         }
     }
     return oid;
@@ -103,29 +100,13 @@ function parseOID(buf) {
 // Parse a boolean from the DER-encoded buffer
 // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean
 function parseBoolean(buf) {
-    // DER requires a BOOLEAN to be a single byte that is either 0x00 (false) or
-    // 0xff (true). Reject any other (non-canonical) encoding.
-    if (buf.length !== 1) {
-        throw new error_1.ASN1ParseError('invalid boolean');
-    }
-    switch (buf[0]) {
-        case 0x00:
-            return false;
-        case 0xff:
-            return true;
-        default:
-            throw new error_1.ASN1ParseError('invalid boolean');
-    }
+    return buf[0] !== 0;
 }
 // Parse a bit string from the DER-encoded buffer
 // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-bit-string
 function parseBitString(buf) {
     // First byte tell us how many unused bits are in the last byte
     const unused = buf[0];
-    // The number of unused bits must be in the range 0-7.
-    if (unused > 7) {
-        throw new error_1.ASN1ParseError('invalid bit string');
-    }
     const start = 1;
     const end = buf.length;
     const bits = [];

package/node_modules/@sigstore/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/core",
-  "version": "4.0.1",
+  "version": "3.2.1",
   "description": "Base library for Sigstore",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -26,6 +26,6 @@
     "provenance": true
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   }
 }

package/node_modules/@sigstore/sign/README.md

@@ -13,7 +13,7 @@ A library for generating [Sigstore][1] signatures.
 
 ## Prerequisites
 
-- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
+- Node.js version ^20.17.0 || >=22.9.0
 
 ## Installation
 

package/node_modules/@sigstore/sign/dist/signer/fulcio/ephemeral.js

@@ -33,7 +33,7 @@ class EphemeralSigner {
         const signature = (0, crypto_1.sign)('sha256', data, this.keypair.privateKey);
         const publicKey = this.keypair.publicKey
             .export({ format: 'pem', type: 'spki' })
-            .toString();
+            .toString('ascii');
         return {
             signature: signature,
             key: { $case: 'publicKey', publicKey },

package/node_modules/@sigstore/sign/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/sign",
-  "version": "5.0.0",
+  "version": "4.1.1",
   "description": "Sigstore signing library",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,19 +27,19 @@
   },
   "devDependencies": {
     "@sigstore/jest": "^0.0.0",
-    "@sigstore/mock": "^0.13.0",
-    "@sigstore/rekor-types": "^5.0.0",
+    "@sigstore/mock": "^0.12.0",
+    "@sigstore/rekor-types": "^4.0.0",
     "@types/make-fetch-happen": "^10.0.4"
   },
   "dependencies": {
-    "@gar/promise-retry": "^1.0.2",
-    "@sigstore/bundle": "^5.0.0",
-    "@sigstore/core": "^4.0.0",
+    "@sigstore/bundle": "^4.0.0",
+    "@sigstore/core": "^3.2.0",
     "@sigstore/protobuf-specs": "^0.5.0",
-    "make-fetch-happen": "^16.0.0",
-    "proc-log": "^7.0.0"
+    "make-fetch-happen": "^15.0.4",
+    "proc-log": "^6.1.0",
+    "@gar/promise-retry": "^1.0.2"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   }
 }

package/node_modules/@sigstore/tuf/README.md

@@ -12,7 +12,7 @@ repository.
 
 ## Prerequisites
 
-- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
+- Node.js version ^20.17.0 || >=22.9.0
 
 ## Installation