MEDIUM5.4npmGHSA-jfc7-64v2-mr8c· CVE-2026-48758@sigstore/core has DSSE payloadType type-binding failureModified: 9/10/2026