Merge pull request #9170 from BitGo/yashvanthbl137/cgd-2015-fix-sigstore-high-vulnerability-ghsa-52v5-jr5w-gjxr-in

fix(root): bump sigstore to 4.1.1 to fix GHSA-52v5-jr5w-gjxr

Author: danielpeng1

.iyarc

@@ -67,22 +67,6 @@ GHSA-9ppj-qmqm-q256
 # - No patched version of sjcl exists upstream (first_patched_version: null)
 GHSA-2w8x-224x-785m
 
-# Excluded because:
-# - XSS via xmp raw-text passthrough in sanitize-html (severity: critical, CVE-2026-44990)
-# - patched_versions: "<0.0.0" — no upstream fix exists yet
-# - Used in @bitgo/sdk-api to strip all HTML from API error response text (allowedTags: [])
-# - Output is appended to a JavaScript error string server-side, never rendered as HTML in a browser
-# - The xmp bypass produces live HTML markup in output, but since we discard all tags and use
-#   the result as plain text in Error messages, there is no DOM rendering path and no XSS risk
-GHSA-rpr9-rxv7-x643
-
-# Excluded because:
-# - CVE affects esbuild's Deno distribution only: binary downloads without SHA-256 integrity verification
-# - BitGoJS is a Node.js project; the Node.js esbuild distribution already includes binaryIntegrityCheck()
-# - esbuild is a dev-time build tool (via babylonlabs-io-btc-staking-ts), not runtime production code
-# - The attacker-controlled NPM_CONFIG_REGISTRY vector does not apply to our controlled CI environment
-GHSA-gv7w-rqvm-qjhr
-
 # Excluded because:
 # - ws: Memory exhaustion DoS by sending many tiny fragments/data chunks to exhaust server memory
 # - Transitive dependency via @cosmjs/socket, @ethersproject/providers, @polkadot/rpc-provider,

package.json

@@ -133,7 +133,8 @@
     "@babel/plugin-transform-modules-systemjs": "7.29.4",
     "protobufjs": "7.5.8",
     "@protobufjs/fetch": "1.1.0",
-    "@protobufjs/inquire": "1.1.0"
+    "@protobufjs/inquire": "1.1.0",
+    "sigstore": "4.1.1"
   },
   "workspaces": [
     "modules/*"