chore(deps): Bump canonicalize from 4.0.0 to 5.0.0 in /scripts/vendor

[dependabot]

Bumps canonicalize from 4.0.0 to 5.0.0.

Release notes

Sourced from canonicalize's releases.

v5.0.0

Breaking Changes

• Output that was not valid JSON is fixed. Properties whose value has no JSON representation emitted the bare token undefined, and sparse arrays emitted holes — neither parses:
  • { key: undefined } produced {"key":undefined}, now {}
  • [ , , 1] produced [,,1], now [null,null,1]
  • [function () {}] produced [] — losing an element — now [null]
• Boxed primitives now serialize as their primitive value, as JSON.stringify does: new Number(5) was {} and is now 5; new String('x') was {"0":"x"} and is now "x".
• toJSON() returning undefined now drops the property instead of emitting {"k":undefined}.
• Node.js 22 or later is required. The previous >=18 floor was already broken, since String.prototype.isWellFormed() needs Node 20+.

Any of these change the canonical form, and therefore any signature over it. If you have stored signatures produced by 4.0.0 over documents in these shapes, they will not verify against 5.0.0 output.

Fixes

• Deep nesting no longer overflows the stack. The serializer is now iterative, so nesting depth is bounded by heap rather than call stack. 4.0.0 threw above ~1,000 levels; 50,000+ now works. This closes a denial-of-service vector for untrusted input.

Performance

~1.3x faster than 4.0.0 depending on payload

Documentation

• New README section: best practices for signw duplicate property names are resolved before canonicalize() sees the data.

Commits

• 7d97c70 Drop the introductory paragraph
• e7b5eeb Correct what the duplicate-key case actually costs
• 3fe620d Document best practices for signature schemes
• 1577683 Remove the string and key-sorting dual paths
• 3415fce Reach 100% coverage; update c8 for Node 26
• 5f135ef Split simpletests.js into topic-based test files
• f6ab31a Add review-suggested boundary tests, bump version to 5.0.0
• e225aeb Comment the array-frame marker and per-frame resume semantics
• 1e81b3d Clarify boxed-primitive comment: JSON.stringify is mirrored, not called
• 3d96106 Bump minimum Node.js to 22, test on 22/24/26
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
canonicalize	[>= 3.a, < 4]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)