[dependabot]

Bumps asn1js from 3.1.0 to 4.0.0.

Release notes

Sourced from asn1js's releases.

v4.0.0

4.0.0 (2026-10-19)

⚠ BREAKING CHANGES

• asn1js is ESM-only and requires Node.js ^20.19.0 || >=22.12.0 (previously >=12.0.0), so Node.js versions below 20.19 and 22.0-22.11 are no longer supported. The CommonJS build is removed: build/index.js (CommonJS) and build/index.es.js are replaced by a single ES module, build/index.js, with build/index.d.ts, and the new exports map blocks deep imports into build/. CommonJS code can still require("asn1js") on supported Node.js versions through require(esm). TypeScript projects that compile to CommonJS need "module": "node20" or "nodenext". pvtsutils and pvutils are replaced by @​peculiar/utils ^4.1. The exported API is unchanged, but new Integer({ value }) and the valueDec setter throw a RangeError for non-integer numbers (v3 truncated them), and encoding a UTCTime with a year outside 1950-2049 throws a RangeError, including new UTCTime({ valueDate }) (v3 wrapped 2050 to 1950; use GeneralizedTime). Integer.fromBigInt encodes negative values correctly, UniversalString encodes characters outside the BMP as single UCS-4 code points (v3 wrote surrogate pairs, which still decode), OID arcs and tag numbers from 2^49 to 2^53 now encode, and an odd-length BMPString or a UniversalString whose length isn't a multiple of 4 returns a decode error instead of throwing. Libraries that check instanceof against asn1js classes (pkijs, @​peculiar/asn1-schema) must use the same asn1js major as the application. See "Breaking Changes In v4" in the README.

Build System

• ship ESM-only output for Node.js ^20.19.0 || >=22.12.0 (#210) (56d4f49)

Commits

• 029442f chore(release): v4.0.0 (#215)
• 56d4f49 build!: ship ESM-only output for Node.js ^20.19.0 || >=22.12.0 (#210)
• 5205e10 refactor(deps): replace pvtsutils and pvutils with @​peculiar/utils 4 (#213)
• 09b1bc0 test(utf8string): cover invalid UTF-8, leading BOM, and lone surrogates (#214)
• 3b6ead5 test: colocate tests as src/**/*.spec.ts (#212)
• 3d5946a style: adopt the shared oxlint and oxfmt config (#211)
• 041703b ci: release with release-please (#209)
• d73e573 chore(website): update dependencies (#208)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)