chore(deps): bump sigstore and @angular/cli

[dependabot]

Bumps sigstore to 4.1.1 and updates ancestor dependency @angular/cli. These dependencies need to be updated together.

Updates sigstore from 3.1.0 to 4.1.1

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

• 7845532: Verification of OID certificate extensions
• f074710: Require inclusion promise in Rekor entry when used as timestamp source
• Updated dependencies [b5aa4f1]
• Updated dependencies [7845532]
• Updated dependencies [f074710]
  • @​sigstore/core@​3.2.1
  • @​sigstore/verify@​3.1.1

sigstore@4.1.0

Minor Changes

• eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

• Updated dependencies [cee51c0]
• Updated dependencies [2042aad]
• Updated dependencies [018974e]
• Updated dependencies [dea916f]
• Updated dependencies [61a4f9e]
• Updated dependencies [5ffadc0]
• Updated dependencies [5ffadc0]
• Updated dependencies [1663b3e]
  • @​sigstore/tuf@​4.0.1
  • @​sigstore/verify@​3.1.0
  • @​sigstore/sign@​4.1.0
  • @​sigstore/core@​3.1.0

sigstore@4.0.0

Major Changes

• 383e200: Drop support for node 18

Patch Changes

• Updated dependencies [40395f5]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
  • @​sigstore/tuf@​4.0.0
  • @​sigstore/sign@​4.0.0
  • @​sigstore/bundle@​4.0.0
  • @​sigstore/verify@​3.0.0
  • @​sigstore/core@​3.0.0

Commits

• c1dc7d4 Version Packages (#1607)
• f074710 reject integratedTime w/o inclusionPromise (#1659)
• 7845532 OID certificate extension verification (#1658)
• b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
• c7a34e0 clarify cert ID matching (#1656)
• 9858bd7 Upgrade TypeScript to 6.x (#1655)
• 8cef20d bump qs from 6.15.1 to 6.15.2 (#1654)
• aca341b bump @​sigstore/mock deps (#1653)
• 0855aca Pin all @​swc/core platform binaries as optionalDependencies (#1652)
• 44a374d Pin all @​swc/core platform binaries as optionalDependencies (#1650)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sigstore since your current version.

Updates @angular/cli from 19.2.25 to 22.0.5

Release notes

Sourced from @​angular/cli's releases.

22.0.5

@​schematics/angular

Commit	Description
	remove unused app tsconfig outDir

@​angular/cli

Commit	Description
	gracefully handle package manager errors in command handler
	respect release age policy in update bootstrapping logic

@​angular-devkit/build-angular

Commit	Description
	prevent OS command injection in ssr-dev-server builder

@​angular/build

Commit	Description
	auto-inject localize/init in library unit tests
	inherit preserveSymlinks option from build target in unit-test builder
	load zone.js dynamically for library unit tests
	scope createRequire module resolution using paths to prevent parent paths

@​angular/ssr

Commit	Description
	preserve response headers during redirect

22.0.4

@​angular/build

Commit	Description
	aggregate parallel worker performance timings on the main thread
	dispose builder result context early in non-watch mode

22.0.3

@​schematics/angular

Commit	Description
	remove default workspace vscode mcp.json configuration

22.0.2

@​angular/cli

Commit	Description
	support registry metadata fetching under bun package manager
	implement semaphore backpressure throttling in PackageManager

@​angular/build

Commit	Description
	implement semaphore backpressure throttling in JavaScriptTransformer

@​angular/ssr

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

22.0.5 (2026-07-01)

@​angular/cli

Commit	Type	Description
f099e641c	fix	gracefully handle package manager errors in command handler
cf033ec48	fix	respect release age policy in update bootstrapping logic

@​schematics/angular

Commit	Type	Description
862a38069	fix	remove unused app tsconfig outDir

@​angular-devkit/build-angular

Commit	Type	Description
f75085f4b	fix	prevent OS command injection in ssr-dev-server builder

@​angular/build

Commit	Type	Description
dfee1e7b1	fix	auto-inject localize/init in library unit tests
aba718403	fix	inherit preserveSymlinks option from build target in unit-test builder
7c0d9f03c	fix	load zone.js dynamically for library unit tests
4288e4452	fix	scope createRequire module resolution using paths to prevent parent paths

@​angular/ssr

Commit	Type	Description
5f774f891	fix	preserve response headers during redirect

21.2.18 (2026-07-01)

@​angular/cli

Commit	Type	Description
61a810ab6	fix	respect release age policy in update bootstrapping logic

@​angular/build

... (truncated)

Commits

• 85a2698 release: cut the v22.0.5 release
• 5c892ee build: update cross-repo angular dependencies
• 7848e8d build: lock file maintenance
• 862a380 fix(@​schematics/angular): remove unused app tsconfig outDir
• 4288e44 fix(@​angular/build): scope createRequire module resolution using paths to pre...
• 5f774f8 fix(@​angular/ssr): preserve response headers during redirect
• 7c0d9f0 fix(@​angular/build): load zone.js dynamically for library unit tests
• f75085f fix(@​angular-devkit/build-angular): prevent OS command injection in ssr-dev-s...
• f099e64 fix(@​angular/cli): gracefully handle package manager errors in command handler
• cf033ec fix(@​angular/cli): respect release age policy in update bootstrapping logic
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
@angular/cli	[> 19.2.25]

[Junjiequan]

@dependabot ignore this major version

[dependabot]

This option is only available on single-dependency pull requests, as the versions in multi-dependency pull requests may differ.

If you'd like to ignore all updates for these dependencies just reply @dependabot ignore these dependencies.

[Junjiequan]

@dependabot ignore these dependencies

[dependabot]

OK, I won't notify you about any of these dependencies again, unless you re-open this PR.