[dependabot]

Bumps jose from 6.2.12 to 6.2.13.

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

Commits

• 316b7f2 chore(release): 6.2.13
• 8106395 chore: bump packages
• 724ba24 refactor: preserve underlying error causes
• b112a5e chore: bump packages
• 2a3a525 chore(deps-dev): bump workerd in /tap/workerd
• 8f540d8 chore(deps): bump the actions group with 3 updates
• 8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
• 55c959f ci: use gh run rerun for retries
• 5b00c64 ci: address zizmor findings and bump shared workflows
• 1761d7f chore: bump packages
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: npm, sdk-ts. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/jose	6.2.13	🟢 7.5	Details Check Score Reason Code-Review ⚠️ 0 Found 0/26 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts. SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• packages/sdk-ts/package-lock.json

[mishrasanjeev]

Reviewed exact head 1c92d26: only one SDK runtime jose lock record changes from 6.2.12 to 6.2.13. Upstream refactor and error-cause changes were checked against the SDK wrappers and unchanged RS256/ES256 allowlist. Fresh exact-candidate Node 26.12.1 Docker validation passed 1552 SDK tests including 20 actual Postgres/Redis caps checks, 10 actual-jose built-SDK loopback-JWKS error/algorithm/expiry controls, 15 actual local built-SDK HTTP checks, 16 policy tests, builds/typecheck, all 40 npm audits and secret/vendor gates, all without failures/skips. The existing Grant.id versus grantId type/wire discrepancy remains explicit and unfixed. All 48 current-head checks succeeded with two expected skips; all seven workflows succeeded including Base compatibility, security, CodeQL and authority; no open PR CodeQL alerts. No source/manifest/version/override/security-policy or auth context change. No production/provider/merchant/financial coverage or SDK publication claimed.