build(deps): bump the npm_and_yarn group across 1 directory with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: markdown-it and @sigstore/core.

Updates markdown-it from 14.1.0 to 14.3.0

Changelog

Sourced from markdown-it's changelog.

[14.3.0] - 2026-07-02

Changed

• Reworked build pipeline & tools.
• Added source maps.
• Bumped linkify-it to 5.0.2.

Fixed

• Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

• isPunctCharCode to utilities.

Fixed

• Don't end HTML comment blocks on a blank line, #1155.
• Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts with improving CJK support.
• Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
• More strict entities decode to avoid false positives ;, #1096.
• Restore block parser state on fail in lheading rule, #1131.

Security

• Fixed poor smartquotes perfomance on > 70k quotes in single block
• Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

• Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @​ltduc147 for report.

Commits

• ff0ee08 14.3.0 released
• 52e2749 Bump linkify-it / vite deps
• 56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
• 0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
• 83450e2 Rework benchmark deps and bump versions
• 57a6863 benchmark => tinybench
• 7608db1 Update CI config
• 9d8eb42 Added package-lock and updated versions to latest possible
• 0aee70d lint: enable @​stylistic/no-multi-spaces rule
• 8878985 lint => neostandard
• Additional commits viewable in compare view

Updates @sigstore/core from 2.0.0 to 3.2.1

Release notes

Sourced from @​sigstore/core's releases.

@​sigstore/core@​3.2.1

Patch Changes

• b5aa4f1: Apply UTF-8 encoding to payload type during PAE calculation

@​sigstore/core@​3.2.0

Minor Changes

• 8f736ef: Update the createPublicKey function to support base64-encoded keys

@​sigstore/core@​3.0.0

Major Changes

• 383e200: Drop support for node 18

Commits

• c1dc7d4 Version Packages (#1607)
• f074710 reject integratedTime w/o inclusionPromise (#1659)
• 7845532 OID certificate extension verification (#1658)
• b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
• c7a34e0 clarify cert ID matching (#1656)
• 9858bd7 Upgrade TypeScript to 6.x (#1655)
• 8cef20d bump qs from 6.15.1 to 6.15.2 (#1654)
• aca341b bump @​sigstore/mock deps (#1653)
• 0855aca Pin all @​swc/core platform binaries as optionalDependencies (#1652)
• 44a374d Pin all @​swc/core platform binaries as optionalDependencies (#1650)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​sigstore/core since your current version.

Updates sigstore from 3.1.0 to 4.1.1

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

• 7845532: Verification of OID certificate extensions
• f074710: Require inclusion promise in Rekor entry when used as timestamp source
• Updated dependencies [b5aa4f1]
• Updated dependencies [7845532]
• Updated dependencies [f074710]
  • @​sigstore/core@​3.2.1
  • @​sigstore/verify@​3.1.1

sigstore@4.1.0

Minor Changes

• eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

• Updated dependencies [cee51c0]
• Updated dependencies [2042aad]
• Updated dependencies [018974e]
• Updated dependencies [dea916f]
• Updated dependencies [61a4f9e]
• Updated dependencies [5ffadc0]
• Updated dependencies [5ffadc0]
• Updated dependencies [1663b3e]
  • @​sigstore/tuf@​4.0.1
  • @​sigstore/verify@​3.1.0
  • @​sigstore/sign@​4.1.0
  • @​sigstore/core@​3.1.0

sigstore@4.0.0

Major Changes

• 383e200: Drop support for node 18

Patch Changes

• Updated dependencies [40395f5]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
  • @​sigstore/tuf@​4.0.0
  • @​sigstore/sign@​4.0.0
  • @​sigstore/bundle@​4.0.0
  • @​sigstore/verify@​3.0.0
  • @​sigstore/core@​3.0.0

Commits

• c1dc7d4 Version Packages (#1607)
• f074710 reject integratedTime w/o inclusionPromise (#1659)
• 7845532 OID certificate extension verification (#1658)
• b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
• c7a34e0 clarify cert ID matching (#1656)
• 9858bd7 Upgrade TypeScript to 6.x (#1655)
• 8cef20d bump qs from 6.15.1 to 6.15.2 (#1654)
• aca341b bump @​sigstore/mock deps (#1653)
• 0855aca Pin all @​swc/core platform binaries as optionalDependencies (#1652)
• 44a374d Pin all @​swc/core platform binaries as optionalDependencies (#1650)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sigstore since your current version.

Updates tar from 7.5.11 to 7.5.19

Commits

• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• Additional commits viewable in compare view

[github-actions]

Single Commit Policy — COMPLIANT

Status: 1 commit | Valid format | No merge commits | Ready for merge

Commit details

• Hash: 44cad71572d7889c8ad70eedce15dce773a92a14
• Message: build(deps): bump the npm_and_yarn group across 1 directory with 4 updates
• Author: dependabot[bot]

---

Automated validation — dopamine single-commit enforcement

[murdore]

Reviewed — routine dependency-bump PR, checks out.

• All 3 version bumps are devDependencies only (release/lint tooling): @semantic-release/npm 12→13, semantic-release 24→25, markdownlint-cli2 0.17→0.23. None of these load into the running dashboard-server.ts process, so this doesn't hit the Express-4→5-style "CI green but server crashes on boot" failure mode seen before in this repo (build(deps): bump express and @types/express #21).
• CI is all green, including the dedicated "Validate semantic-release config" check, which is the most relevant signal for a semantic-release major bump.
• Diff is scoped to package.json + package-lock.json only — no unrelated changes bundled in.

No blockers from me.