Skip to content

Commit aa3898f

Browse files
authored
chore(cve): Update node-forge to 1.3.3 (#4289)
GHSA-554w-wpv2-vw27 Taking on a direct dependency is not great 1. We don't actually use node-forge - it's only needed by webpack-dev-server's dependency (selfsigned) for generating self-signed certificates during development 2. Adding a direct dependency would be misleading - it suggests our code uses node-forge when it doesn't In the dependency chain: ``` @docusaurus/core@3.8.1 └─ webpack-dev-server@4.15.2 └─ selfsigned@2.4.1 └─ node-forge@1.3.1 ``` Latest Docusaurus (3.9.2) uses webpack-dev-server 5.2.2, which still uses selfsigned 2.4.1 So, overriding dependency on node-forge is the only option
1 parent 3c2d74f commit aa3898f

2 files changed

Lines changed: 5 additions & 4 deletions

File tree

docs/package-lock.json

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

docs/package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@
3232
"remark-code-import": "^1.2.0"
3333
},
3434
"overrides": {
35-
"glob": "^10.5.0"
35+
"glob": "^10.5.0",
36+
"node-forge": "^1.3.2"
3637
},
3738
"browserslist": {
3839
"production": [

0 commit comments

Comments
 (0)