Update dependency sigstore to v4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sigstore (source)	^3.0.0 → ^4.0.0

---

sigstore's certificateOIDs verification constraints are silently dropped and never enforced

CVE-2026-48815 / GHSA-52v5-jr5w-gjxr

More information

Details

Summary

The documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.

Details

The public verify options include certificateOIDs and the documentation says those OID/value pairs “must be present in the certificate’s extension list.” The policy-construction path used by sigstore.verify() and createVerifier() only copies the SAN and issuer settings into the verification policy and completely ignores certificateOIDs.

As a result, callers can believe they are constraining verification to certificates carrying specific Fulcio or workload-identifying OIDs, while the actual verifier never receives those constraints. Any bundle that satisfies the remaining checks is accepted even if the required OID extensions are absent or mismatched.

This is reachable from supported usage through the documented certificateOIDs verify option.

PoC

const { createVerificationPolicy } = require("sigstore/dist/config");

const policy = createVerificationPolicy({
  certificateIssuer: "https://issuer.example",
  certificateIdentityEmail: "victim@example.com",
  certificateOIDs: {
    "1.2.3.4": "required-value",
  },
});

console.log("certificateOIDs" in policy, JSON.stringify(policy));
// false {"subjectAlternativeName":"victim@example.com","extensions":{"issuer":"https://issuer.example"}}

Impact

Applications that rely on certificateOIDs to restrict which certificates may sign artifacts receive no such protection. Unauthorized certificates that should be rejected on extension policy can be accepted as long as they satisfy the remaining verification checks.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
• https://github.com/sigstore/sigstore-js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sigstore/sigstore-js (sigstore)

v4.1.1

Compare Source

Patch Changes

• 7845532: Verification of OID certificate extensions
• f074710: Require inclusion promise in Rekor entry when used as timestamp source
• Updated dependencies [b5aa4f1]
• Updated dependencies [7845532]
• Updated dependencies [f074710]
  • @​sigstore/core@​3.2.1
  • @​sigstore/verify@​3.1.1

v4.1.0

Compare Source

Minor Changes

• eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

• Updated dependencies [cee51c0]
• Updated dependencies [2042aad]
• Updated dependencies [018974e]
• Updated dependencies [dea916f]
• Updated dependencies [61a4f9e]
• Updated dependencies [5ffadc0]
• Updated dependencies [5ffadc0]
• Updated dependencies [1663b3e]
  • @​sigstore/tuf@​4.0.1
  • @​sigstore/verify@​3.1.0
  • @​sigstore/sign@​4.1.0
  • @​sigstore/core@​3.1.0

v4.0.0

Compare Source

Major Changes

• 383e200: Drop support for node 18

Patch Changes

• Updated dependencies [40395f5]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
  • @​sigstore/tuf@​4.0.0
  • @​sigstore/sign@​4.0.0
  • @​sigstore/bundle@​4.0.0
  • @​sigstore/verify@​3.0.0
  • @​sigstore/core@​3.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.