Bump oxc-parser to >=0.90.0: 0.76.0 bindings lack build provenance

まず ComponentizeJS で oxc-parser の依存関係宣言を見つけ、バージョンがどのように制約されているかを確認します。ビルドの出所を強制するインストール設定で依存関係の更新を検証します。componentize-js とその下流の jco のインストールで、パッケージごとの出所例外が不要になれば完了です。

Would you consider bumping the oxc-parser dependency to >=0.90.0? At 0.76.0 its platform bindings publish without build provenance, which makes anything depending on componentize-js uninstallable under an installer that enforces provenance.

Filed here at the jco maintainers' suggestion — this started as bytecodealliance/jco#1841, and the reply was that the dependency needs updating here first.

The chain is jco@1.27.0 → @bytecodealliance/componentize-js@^0.22.0 → oxc-parser@^0.76.0. All 15 @oxc-parser/binding-* packages at 0.76.0 are missing build provenance attestations, while oxc-parser and @oxc-project/types at the same version have them.

It looks like a gap in one range rather than the norm: @oxc-parser/binding-darwin-arm64 has attestations at 0.13.3, none at 0.76.0, and has them again from 0.90.0 through the current 0.143.0. npm registry signatures are present throughout — build provenance specifically is what is missing.

Installers that enforce provenance and treat a loss of attestation as a downgrade refuse the install outright. It is not host-specific either: the resolver walks every optional binding, so all 15 have to be excluded individually to get past it, including the 13 for platforms a given project will never run.

Bumping to >=0.90.0 would let componentize-js and jco install cleanly under those policies with no per-package exceptions.