build(deps-dev): bump canonicalize from 4.0.0 to 5.1.0 in /packages/trilean

[dependabot]

Bumps canonicalize from 4.0.0 to 5.1.0.

Release notes

Sourced from canonicalize's releases.

v5.1.0

Fixes

• require() now resolves the package. The exports map had only import and types conditions, so Node 22.12+, which can require() an ES module, still failed to load it. A default condition was added:

  const canonicalize = require('canonicalize').default;

  require() of an ES module returns the module namespace, so the function is reached through .default. This is now documented in the README and covered by test/exports.js, which resolves the package by name so that the exports map is exercised rather than bypassed. Thanks to @​mirceanis (#34).

Supply chain

• Releases are published from CI with npm trusted publishing, so each release carries a provenance attestation lil to the commit and workflow that built it.

Documentation

• Added a comparison with the other JCS implementations on npm, covering RFC 8785 vector compliance, 10,000 ES6 numblone surrogates, benchmarks, nesting depth, output validity and bundle size: https://erdtman.github.io/json-canonicalisa

Canonical output is unchanged from 5.0.0 — si.0 output still verify. The Node floor stays at 22, though require() itself needs 22.12.

v5.0.0

Breaking Changes

• Output that was not valid JSON is fixed. Properties whose value has no JSON representation emitted the bare token undefined, and sparse arrays emitted holes — neither parses:
  • { key: undefined } produced {"key":undefined}, now {}
  • [ , , 1] produced [,,1], now [null,null,1]
  • [function () {}] produced [] — losing an element — now [null]
• Boxed primitives now serialize as their primitive value, as JSON.stringify does: new Number(5) was {} and is now 5; new String('x') was {"0":"x"} and is now "x".
• toJSON() returning undefined now drops the property instead of emitting {"k":undefined}.
• Node.js 22 or later is required. The previous >=18 floor was already broken, since String.prototype.isWellFormed() needs Node 20+.

Any of these change the canonical form, and therefore any signature over it. If you have stored signatures produced by 4.0.0 over documents in these shapes, they will not verify against 5.0.0 output.

... (truncated)

Commits

• 31fb117 Stage releases instead of publishing them directly
• 30454e1 5.1.0
• cc99a8b Install with npm install when publishing
• 9faeed3 Publish from CI with trusted publishing and provenance
• 80f1cb7 Link the JCS library comparison from the README
• c5ac53e Cover and document the CommonJS entry point
• 94c201c Add a default export to package.json
• 7d97c70 Drop the introductory paragraph
• e7b5eeb Correct what the duplicate-key case actually costs
• 3fe620d Document best practices for signature schemes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for canonicalize since your current version.

[dependabot]

Looks like canonicalize is up-to-date now, so this is no longer needed.