NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #3107 most downloaded on npm
Sigstore signing library
Last release 4 months ago
01 Jun 2026
Ships fairly regularly
a new release about every 3 months
Nearly every release is documented
notes for 17 of 17 stable releases
Nothing withdrawn
no release was ever pulled
3 years old
17 releases · first in 2023
One column per quarter.
46c00b3: Drop support for Node 20
tuf-js from 4.x to 5.0.1tuf-js from 5.0.1 to 6.0.0adbe253: Deduplicate transparency-log entries before counting them toward tlogThreshold, so repeated copies of a single entry no longer over-count. Th
tlogThreshold, so repeated copies of a single entry no longer over-count. This matches the existing duplicate checks for timestamps and SCTs in the same verifier.promise-retry library for @gar/promise-retrymake-fetch-happen from 15.0.3 to 15.0.4754e2a3: Support verification of DSSE bundles with a Rekor v2 hashedrekord transparency log entry, where the entry's digest is computed over the DSSE
hashedrekord transparency log entry, where the entry's digest is computed over the DSSE pre-authentication encoding (PAE) rather than the envelope payload04ea25a: ASN.1 parser hardening
46c00b3: Drop support for Node 20
74cc6c5: Bump @sigstore/protobuf-specs from 0.3.2 to 0.4.0
383e200: Drop support for node 18
tuf-js from 2.2.1 to 3.0.0DSSEBundleBuilder to generating v0.3 bundlesRekorWitness to generating "dsse" entries instead of "intoto"toDSSEBundle and toMessageSignatureBundle generate v0.3 bundles by defaultcf0c3ef: Bump @sigstore/protobuf-specs from 0.3.1 to 0.3.2
9d300e8: Bump make-fetch-happen from 13.0.0 to 13.0.1
require instead of require.resolve77e9e17: Updates the DSSEBundleBuilder with a new singleCertificate option which will trigger the creation of v0.3 Sigstore bundles
DSSEBundleBuilder with a new singleCertificate option which will trigger the creation of v0.3 Sigstore bundlesforceCache option for TUF client555dd8e: Bump @sigstore/protobuf-specs from 0.2.1 to 0.3.0
### Patch Changes - Updated dependencies [7d90262] - @sigstore/core@1.0.0
34c3856: Integrate @sigstore/core package
@sigstore/core package555dd8e: Support for validating v0.3 bundles
entryType option on RekorWitness constructorforce option to force re-initialization of local TUF cache74cc6c5: Bump @sigstore/protobuf-specs from 0.3.2 to 0.4.0
f89faed: Drop support for node 16
hash function in core packagetuf-js to v2.0.0make-fetch-happen from 11.0.0 to 13.0.0f05be96: Update Rekor verification to handle checkpoint values which do no include timestamps ( )
MessageBundleBuilder class to MessageSignatureBundleBuilder@sigstore/bundle package.SerializedTLogEntry typeenvelopeToJSON/envelopeFromJSON functions for serialization/deserialization of DSSE envelopesThe 1.0.0 release 🎉
Your coding agent can read these notes before it upgrades. Set up the MCP server →