NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #3089 most downloaded on npm
Client for the Sigstore TUF repository
Last release 4 months ago
01 Jun 2026
Ships fairly regularly
a new release about every 3 months
Nearly every release is documented
notes for 19 of 19 stable releases
Nothing withdrawn
no release was ever pulled
3 years old
19 releases · first in 2023
One column per quarter.
46c00b3: Drop support for Node 20
tuf-js from 4.x to 5.0.1tuf-js from 5.0.1 to 6.0.0### Patch Changes - 90804e7: Update TUF seed files
04ea25a: ASN.1 parser hardening
46c00b3: Drop support for Node 20
7845532: Verification of OID certificate extensions
74cc6c5: Bump @sigstore/protobuf-specs from 0.3.2 to 0.4.0
383e200: Drop support for node 18
tuf-js from 2.2.1 to 3.0.0DSSEBundleBuilder to generating v0.3 bundlesRekorWitness to generating "dsse" entries instead of "intoto"toDSSEBundle and toMessageSignatureBundle generate v0.3 bundles by defaultcf0c3ef: Bump @sigstore/protobuf-specs from 0.3.0 to 0.3.2
9d300e8: Bump tuf-js from 2.2.0 to 2.2.1
cf0c3ef: Bump @sigstore/protobuf-specs from 0.3.1 to 0.3.2
c5f0f79: Fix bug in regex for matching media types
require instead of require.resolve77e9e17: Updates the DSSEBundleBuilder with a new singleCertificate option which will trigger the creation of v0.3 Sigstore bundles
DSSEBundleBuilder with a new singleCertificate option which will trigger the creation of v0.3 Sigstore bundlesforceCache option for TUF client555dd8e: Support for validating v0.3 bundles
entryType option on RekorWitness constructorforce option to force re-initialization of local TUF cache74cc6c5: Bump @sigstore/protobuf-specs from 0.3.2 to 0.4.0
f89faed: Drop support for node 16
hash function in core packagetuf-js to v2.0.0make-fetch-happen from 11.0.0 to 13.0.0e0c16ec: Bump @sigstore/protobuf-specs from 0.1.0 to 0.2.0
68a21d0: Re-classify @types/make-fetch-happen as development dependency
@types/make-fetch-happen as development dependencyb97be71: Bump tuf-js from 1.1.6 to 1.1.7
f05be96: Update Rekor verification to handle checkpoint values which do no include timestamps ( )
MessageBundleBuilder class to MessageSignatureBundleBuilder@sigstore/bundle package.SerializedTLogEntry typeenvelopeToJSON/envelopeFromJSON functions for serialization/deserialization of DSSE envelopesThe 1.0.0 release 🎉
Your coding agent can read these notes before it upgrades. Set up the MCP server →