Commit aa3898f
authored
chore(cve): Update node-forge to 1.3.3 (#4289)
GHSA-554w-wpv2-vw27
Taking on a direct dependency is not great
1. We don't actually use node-forge - it's only needed by
webpack-dev-server's dependency (selfsigned) for generating self-signed
certificates during development
2. Adding a direct dependency would be misleading - it suggests our code
uses node-forge when it doesn't
In the dependency chain:
```
@docusaurus/core@3.8.1
└─ webpack-dev-server@4.15.2
└─ selfsigned@2.4.1
└─ node-forge@1.3.1
```
Latest Docusaurus (3.9.2) uses webpack-dev-server 5.2.2, which still
uses selfsigned 2.4.1
So, overriding dependency on node-forge is the only option1 parent 3c2d74f commit aa3898f
2 files changed
Lines changed: 5 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
35 | | - | |
| 35 | + | |
| 36 | + | |
36 | 37 | | |
37 | 38 | | |
38 | 39 | | |
| |||
0 commit comments