Trust-policy provenance downgrade in 5.21.0 -> 5.21.1

[hugo-vrijswijk]

graphql-yoga@5.21.0 was published using npm provenance. But in 5.21.1 the package loses this. Causing a build to fail:

[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "graphql-yoga@5.21.1" (possible package takeover)

This error happened while installing a direct dependency of /tmp/renovate/repos/github/gemini-hlsw/lucuma-ts/packages/configs

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.

What happened here?

[enisdenjo]

Thanks for reporting! We have addressed this in #4518 and will be releasing a new stable version shortly.