[dependabot]

Bumps canonicalize from 2.1.0 to 5.1.0.

Release notes

Sourced from canonicalize's releases.

v5.1.0

Fixes

• require() now resolves the package. The exports map had only import and types conditions, so Node 22.12+, which can require() an ES module, still failed to load it. A default condition was added:

  const canonicalize = require('canonicalize').default;

  require() of an ES module returns the module namespace, so the function is reached through .default. This is now documented in the README and covered by test/exports.js, which resolves the package by name so that the exports map is exercised rather than bypassed. Thanks to @​mirceanis (#34).

Supply chain

• Releases are published from CI with npm trusted publishing, so each release carries a provenance attestation lil to the commit and workflow that built it.

Documentation

• Added a comparison with the other JCS implementations on npm, covering RFC 8785 vector compliance, 10,000 ES6 numblone surrogates, benchmarks, nesting depth, output validity and bundle size: https://erdtman.github.io/json-canonicalisa

Canonical output is unchanged from 5.0.0 — si.0 output still verify. The Node floor stays at 22, though require() itself needs 22.12.

v5.0.0

Breaking Changes

• Output that was not valid JSON is fixed. Properties whose value has no JSON representation emitted the bare token undefined, and sparse arrays emitted holes — neither parses:
  • { key: undefined } produced {"key":undefined}, now {}
  • [ , , 1] produced [,,1], now [null,null,1]
  • [function () {}] produced [] — losing an element — now [null]
• Boxed primitives now serialize as their primitive value, as JSON.stringify does: new Number(5) was {} and is now 5; new String('x') was {"0":"x"} and is now "x".
• toJSON() returning undefined now drops the property instead of emitting {"k":undefined}.
• Node.js 22 or later is required. The previous >=18 floor was already broken, since String.prototype.isWellFormed() needs Node 20+.

Any of these change the canonical form, and therefore any signature over it. If you have stored signatures produced by 4.0.0 over documents in these shapes, they will not verify against 5.0.0 output.

... (truncated)

Commits

• 31fb117 Stage releases instead of publishing them directly
• 30454e1 5.1.0
• cc99a8b Install with npm install when publishing
• 9faeed3 Publish from CI with trusted publishing and provenance
• 80f1cb7 Link the JCS library comparison from the README
• c5ac53e Cover and document the CommonJS entry point
• 94c201c Add a default export to package.json
• 7d97c70 Drop the introductory paragraph
• e7b5eeb Correct what the duplicate-key case actually costs
• 3fe620d Document best practices for signature schemes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for canonicalize since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)