Repository navigation
chore(deps): stub out node-forge, which has no fixed release - #290
Merged
Merged
Conversation
node-forge <=1.4.0 carries GHSA-86w9-cpqp-85rv with no patched version. Its only user is listhen, for `nuxt dev --https` self-signed certs. A local stand-in replaces it via overrides; touching it throws. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GpshKC4WXpYdXWj6Ptew4q
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GpshKC4WXpYdXWj6Ptew4q
Benyamen9
enabled auto-merge (squash)
October 12, 2026 18:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why:
node-forge≤ 1.4.0 carries GHSA-86w9-cpqp-85rv (high: RSA PKCS#1 v1.5 signature forgery), and no patched release exists. The upstream fix, digitalbazaar/forge#1152, is still unmerged.Where it's used: its only user here is
listhen(via nitropack), and only to generate self-signed certificates fornuxt dev --https.Change:
vendor/node-forge/is our own stand-in package with no dependencies. Loading it is harmless; reading any forge API throws an error that explains why.file:./vendor/node-forgeplusoverrides: { "node-forge": "$node-forge" }. A relativefile:path insideoverridesalone resolves against listhen's folder, so it needs the$reference.vendor/beforenpm ci.Cost:
nuxt dev --httpsstops working until the stand-in is removed. Nothing else changes: forge is not in.output.Verified:
npm cion a clean copy exits 0,node_modules/node-forgelinks to../vendor/node-forge, andnpm auditno longer lists node-forge.npm ci: typecheck 0, eslint clean, unit tests pass,nuxt build0.nuxt devserves/with HTTP 200, and DevTools loads.Remove when node-forge ships a fix: delete
vendor/, the dev dependency, the override and the Dockerfile line.🤖 Generated with Claude Code
https://claude.ai/code/session_01GpshKC4WXpYdXWj6Ptew4q