build(deps): bump sigstore and @angular/cli

[dependabot]

Bumps sigstore to 4.1.1 and updates ancestor dependency @angular/cli. These dependencies need to be updated together.

Updates sigstore from 2.3.1 to 4.1.1

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

• 7845532: Verification of OID certificate extensions
• f074710: Require inclusion promise in Rekor entry when used as timestamp source
• Updated dependencies [b5aa4f1]
• Updated dependencies [7845532]
• Updated dependencies [f074710]
  • @​sigstore/core@​3.2.1
  • @​sigstore/verify@​3.1.1

sigstore@4.1.0

Minor Changes

• eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

• Updated dependencies [cee51c0]
• Updated dependencies [2042aad]
• Updated dependencies [018974e]
• Updated dependencies [dea916f]
• Updated dependencies [61a4f9e]
• Updated dependencies [5ffadc0]
• Updated dependencies [5ffadc0]
• Updated dependencies [1663b3e]
  • @​sigstore/tuf@​4.0.1
  • @​sigstore/verify@​3.1.0
  • @​sigstore/sign@​4.1.0
  • @​sigstore/core@​3.1.0

sigstore@4.0.0

Major Changes

• 383e200: Drop support for node 18

Patch Changes

• Updated dependencies [40395f5]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
• Updated dependencies [383e200]
  • @​sigstore/tuf@​4.0.0
  • @​sigstore/sign@​4.0.0
  • @​sigstore/bundle@​4.0.0
  • @​sigstore/verify@​3.0.0
  • @​sigstore/core@​3.0.0

sigstore@3.1.0

Minor Changes

... (truncated)

Commits

• c1dc7d4 Version Packages (#1607)
• f074710 reject integratedTime w/o inclusionPromise (#1659)
• 7845532 OID certificate extension verification (#1658)
• b5aa4f1 proper utf-8 encoding in DSSE PAE (#1657)
• c7a34e0 clarify cert ID matching (#1656)
• 9858bd7 Upgrade TypeScript to 6.x (#1655)
• 8cef20d bump qs from 6.15.1 to 6.15.2 (#1654)
• aca341b bump @​sigstore/mock deps (#1653)
• 0855aca Pin all @​swc/core platform binaries as optionalDependencies (#1652)
• 44a374d Pin all @​swc/core platform binaries as optionalDependencies (#1650)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sigstore since your current version.

Updates @angular/cli from 18.2.20 to 22.0.7

Release notes

Sourced from @​angular/cli's releases.

22.0.7

@​angular/cli

Commit	Description
	copy packageManager field and yarn config for temp installs
	support resolving subproject dependencies in pnpm workspaces

22.0.6

@​angular/build

Commit	Description
	fallback to build target preserveSymlinks option in karma runner
	prevent externalizing builder-injected i18n locale data
	strip all vite id prefixes from minified code with external dependencies

@​angular/ssr

Commit	Description
	replace all route parameters when resolving relative redirects

22.0.5

@​schematics/angular

Commit	Description
	remove unused app tsconfig outDir

@​angular/cli

Commit	Description
	gracefully handle package manager errors in command handler
	respect release age policy in update bootstrapping logic

@​angular-devkit/build-angular

Commit	Description
	prevent OS command injection in ssr-dev-server builder

@​angular/build

Commit	Description
	auto-inject localize/init in library unit tests
	inherit preserveSymlinks option from build target in unit-test builder
	load zone.js dynamically for library unit tests
	scope createRequire module resolution using paths to prevent parent paths

@​angular/ssr

Commit	Description
	preserve response headers during redirect

22.0.4

@​angular/build

Commit	Description
	aggregate parallel worker performance timings on the main thread

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

22.0.7 (2026-07-15)

@​angular/cli

Commit	Type	Description
e85c10ccb	fix	copy packageManager field and yarn config for temp installs
b87cafec0	fix	support resolving subproject dependencies in pnpm workspaces

21.2.19 (2026-07-09)

@​angular-devkit/build-angular

Commit	Type	Description
df5429871	fix	update http-proxy-middleware to 3.0.7

20.3.32 (2026-07-09)

@​angular-devkit/build-angular

Commit	Type	Description
d4e07cb3e	fix	update http-proxy-middleware to 3.0.7

22.1.0-next.3 (2026-07-09)

@​angular/build

Commit	Type	Description
34d558c3c	feat	add built-in SQLite cache store fallback
52ae7f862	feat	share persistent build cache across git worktrees
41bd100dd	fix	fallback to build target preserveSymlinks option in karma runner
6d9b360e5	fix	prevent esbuild service hang on internal component stylesheet builds
85c53d990	fix	prevent externalizing builder-injected i18n locale data
004cc4104	fix	strip all vite id prefixes from minified code with external dependencies
09d0a11a8	perf	enable fast-path AST printing with sourcemaps in AotCompilation

... (truncated)

Commits

• e744701 release: cut the v22.0.7 release
• a902c38 build: lock file maintenance
• 12fb387 build: update pnpm to v10.34.5
• 22d843e build: update cross-repo angular dependencies to v22.0.6
• b87cafe fix(@​angular/cli): support resolving subproject dependencies in pnpm workspaces
• e85c10c fix(@​angular/cli): copy packageManager field and yarn config for temp installs
• 5584a58 build: update babel monorepo to v7.29.7
• cc45a54 build: update dependency http-proxy-middleware to v3.0.7
• 31345b6 build: lock file maintenance
• dbd61b1 release: cut the v22.0.6 release
• Additional commits viewable in compare view

[github-actions]

🔭🐙🐈 Test this branch here: https://db-ui.github.io/elements/review/dependabot-npm_and_yarn-multi-27a3df8e2d