build(deps-dev): bump canonicalize from 4.0.0 to 5.1.0 in /packages/trilean

[dependabot]

Bumps canonicalize from 4.0.0 to 5.1.0.

Release notes

Sourced from canonicalize's releases.

v5.0.0

Breaking Changes

• Output that was not valid JSON is fixed. Properties whose value has no JSON representation emitted the bare token undefined, and sparse arrays emitted holes — neither parses:
  • { key: undefined } produced {"key":undefined}, now {}
  • [ , , 1] produced [,,1], now [null,null,1]
  • [function () {}] produced [] — losing an element — now [null]
• Boxed primitives now serialize as their primitive value, as JSON.stringify does: new Number(5) was {} and is now 5; new String('x') was {"0":"x"} and is now "x".
• toJSON() returning undefined now drops the property instead of emitting {"k":undefined}.
• Node.js 22 or later is required. The previous >=18 floor was already broken, since String.prototype.isWellFormed() needs Node 20+.

Any of these change the canonical form, and therefore any signature over it. If you have stored signatures produced by 4.0.0 over documents in these shapes, they will not verify against 5.0.0 output.

Fixes

• Deep nesting no longer overflows the stack. The serializer is now iterative, so nesting depth is bounded by heap rather than call stack. 4.0.0 threw above ~1,000 levels; 50,000+ now works. This closes a denial-of-service vector for untrusted input.

Performance

~1.3x faster than 4.0.0 depending on payload

Documentation

• New README section: best practices for signw duplicate property names are resolved before canonicalize() sees the data.

Commits

• 31fb117 Stage releases instead of publishing them directly
• 30454e1 5.1.0
• cc99a8b Install with npm install when publishing
• 9faeed3 Publish from CI with trusted publishing and provenance
• 80f1cb7 Link the JCS library comparison from the README
• c5ac53e Cover and document the CommonJS entry point
• 94c201c Add a default export to package.json
• 7d97c70 Drop the introductory paragraph
• e7b5eeb Correct what the duplicate-key case actually costs
• 3fe620d Document best practices for signature schemes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for canonicalize since your current version.