chore(deps): bump @socketregistry/packageurl-js catalog pin to 1.4.5

The 1.4.5 publish dropped the types condition from package.json
exports, leaving the package untyped under nodenext resolution. A
pnpm patch restores the condition pointing at the shipped d.mts files
so the cli typecheck stays green.

Author: jdalton

patches/@socketregistry__packageurl-js@1.4.5.patch

@@ -0,0 +1,17 @@
+diff --git a/package.json b/package.json
+index 8b85785e153a1500a48ec0b081d56e223201fe7f..97fdcb882d27bfea46c87aa5bc42ae888548fb25 100644
+--- a/package.json
++++ b/package.json
+@@ -23,10 +23,12 @@
+   "exports": {
+     ".": {
+       "source": "./src/index.mts",
++      "types": "./dist/index.d.mts",
+       "default": "./dist/index.js"
+     },
+     "./exists": {
+       "source": "./src/exists.mts",
++      "types": "./dist/exists.d.mts",
+       "default": "./dist/exists.js"
+     }
+   },

pnpm-lock.yaml

@@ -65,7 +65,7 @@ catalog:
   '@socketregistry/hyrious__bun.lockb': 1.0.19
   '@socketregistry/indent-string': 1.0.14
   '@socketregistry/is-interactive': 1.0.6
-  '@socketregistry/packageurl-js': 1.4.4
+  '@socketregistry/packageurl-js': 1.4.5
   '@socketsecurity/lib': 6.2.2
   '@types/shell-quote': 1.7.5
   '@ultrathink/acorn.wasm': npm:@ultrathink/acorn-wasm@0.0.1
@@ -76,7 +76,7 @@ catalog:
   # code resolves to the published catalog version regardless of where
   # the importing file lives. See socket-wheelhouse@92cd3e3 for the
   # full rationale.
-  '@socketregistry/packageurl-js-stable': 'npm:@socketregistry/packageurl-js@1.4.4'
+  '@socketregistry/packageurl-js-stable': 'npm:@socketregistry/packageurl-js@1.4.5'
   '@socketregistry/yocto-spinner': 1.0.25
   '@socketsecurity/lib-stable': 'npm:@socketsecurity/lib@6.2.2'
   '@socketsecurity/registry': 'npm:@socketsecurity/registry@2.0.2'
@@ -423,6 +423,11 @@ patchedDependencies:
   # bundle loads on node-smol SEA builds, which ship without http2. Consumer:
   # packages/cli SEA binary.
   '@sigstore/sign@4.1.0': patches/@sigstore__sign@4.1.0.patch
+  # The 1.4.5 publish dropped the "types" condition from package.json exports,
+  # so tsc under nodenext resolves the package as untyped any. Restores the
+  # types condition pointing at the shipped dist/*.d.mts files. Consumer:
+  # packages/cli typecheck via the -stable alias.
+  '@socketregistry/packageurl-js@1.4.5': patches/@socketregistry__packageurl-js@1.4.5.patch
   # signal-exit is deduped to v4, which exports a named onExit instead of the
   # v3 default export execa calls; restores the call contract. Consumer:
   # packages/cli bundled npm tooling.