build(deps): bump openpgp from 6.1.0 to 6.3.0

[dependabot]

Bumps openpgp from 6.1.0 to 6.3.0.

Release notes

Sourced from openpgp's releases.

v6.3.0

What's Changed

• Support Node.js v24 (openpgpjs/openpgpjs#1896)
• Add config option to limit decompressed message size (openpgpjs/openpgpjs#1933) Since decompression can increase the memory usage non-linearly, add a config.maxDecompressedMessageSize option to limit the decompressed message size. By default it's set to Infinity, i.e. no limit. Set the config option to a number of bytes to limit the size of data that gets decompressed.
• Switch from seek-bzip to unbzip2-stream (openpgpjs/openpgpjs#1887) To facilitate the above.
• Use native CompressionStream/DecompressionStream when not streaming (openpgpjs/openpgpjs#1935) For improved compression/decompression performance when not streaming.
• Use bufferless transforms (openpgpjs/openpgpjs#1893) For lower memory usage, especially when streaming.
• JSDoc: make sure only user-facing entities are included in the docs, and add TS support (openpgpjs/openpgpjs#1923)
• Various dependency version bumps
• Various improvements to CI

Full Changelog: openpgpjs/openpgpjs@v6.2.2...v6.3.0

v6.2.2

What's Changed

• Fix zlib compression for data larger than 65KB (openpgpjs/openpgpjs#1894): Affected versions: v6.2.0 and v6.2.1 . As compression is disabled by default in openpgpjs, the issue only affects users who enabled zlib compression via e.g. config.preferredCompressionAlgorithm = openpgp.enums.compression.zlib and encrypted or signed data larger than 65KB.

Full Changelog: openpgpjs/openpgpjs@v6.2.1...v6.2.2

v6.2.1

What's Changed

• Lightweight build: lazy load tweetnacl dependency module (openpgpjs/openpgpjs#1877)
  • Key validation: use WebCrypto API when available for curve25519
• Internal dependency updates

Full Changelog: openpgpjs/openpgpjs@v6.2.0...v6.2.1

v6.2.0

What's Changed

• Implement OpenPGP message grammar validation (add config.enforceGrammar, enabled by default) (#1853)
• Enable using WebCrypto for X25519 when available (#1829)
• Prefer subkeys with higher algorithm IDs (in case of equal creation timestamps), on the assumption that that's the most modern/secure algorithm (#1854)
• Improve packet stream & error handling (#1856):
  • Packet parsing errors in not-yet-authenticated streams (i.e. SEIPDv1 with allowUnauthenticatedStream: true) get delayed until the decrypted data stream is authenticated
  • Non-critical unknown packets get turned into UnparseablePacket` objects on the packet stream instead of being ignored
• Make Issuer Key ID signature subpacket non-critical (#1828)
• Improve type definition for the User class (#1857)

New Contributors

... (truncated)

Commits

• e1cab74 6.3.0
• fccbc3e Use native Compression Streams API when not streaming (#1935)
• a61cf1f Add config option to limit decompressed message size (#1933)
• 6ab6b9c Tests: use native web streams when TransformStream is available (#1934)
• 1b2c842 [npm audit fix] bump glob and js-yaml (#1939)
• 341354f Tests: Stub navigator.hardwareConcurrency in Node v21+
• db9531d Tests: Bump mocha timeout for browser tests (#1941)
• d00821b CI: add workflow permissions (#1937)
• d27ef92 Bump playwright from 1.56.0 to 1.57.0 (#1936)
• 1af590a Switch from seek-bzip to unbzip2-stream (#1887)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by twiss, a new releaser for openpgp since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)