Take node-forge 1.4.2, which fixes four new high advisories in the dev chain #55

Merged

tiagoagueda merged 1 commit from node-forge-1.4.2 into main

2026-10-31 12:40:38 +00:00

tiagoagueda commented

2026-10-31 12:07:57 +00:00

Owner

npm audit started refusing four high advisories in node-forge 1.4.0 (GHSA-jc66-7q78-782g, GHSA-8hrf-8g6f-7xwp, GHSA-hqq3-7jhf-c5jx, GHSA-5x38-2vff-x55p), reached through web-ext → @devicefarmer/adbkit. Every pull request's check job failed on it, Weblate's included.

node-forge 1.4.2 fixes them, and GHSA-86w9-cpqp-85rv too, so that entry leaves the allow list in scripts/audit.mjs.
Only package-lock.json moves; nothing the extension ships changes.

Locally: node scripts/audit.mjs passes, npm test passes.

🤖 Generated with Claude Code

`npm audit` started refusing four high advisories in node-forge 1.4.0 (GHSA-jc66-7q78-782g, GHSA-8hrf-8g6f-7xwp, GHSA-hqq3-7jhf-c5jx, GHSA-5x38-2vff-x55p), reached through web-ext → @devicefarmer/adbkit. Every pull request's `check` job failed on it, Weblate's included. - node-forge 1.4.2 fixes them, and GHSA-86w9-cpqp-85rv too, so that entry leaves the allow list in `scripts/audit.mjs`. - Only `package-lock.json` moves; nothing the extension ships changes. Locally: `node scripts/audit.mjs` passes, `npm test` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit

2026-10-31 12:07:57 +00:00

Take node-forge 1.4.2, which fixes four new high advisories in the dev chain

CI / check (pull_request) Successful in 40s

Details

d64b502236

npm audit refused GHSA-jc66-7q78-782g, GHSA-8hrf-8g6f-7xwp,
GHSA-hqq3-7jhf-c5jx and GHSA-5x38-2vff-x55p in node-forge 1.4.0, reached
through web-ext's @devicefarmer/adbkit, so every pull request's check job
failed, Weblate's included. 1.4.2 fixes them, and GHSA-86w9-cpqp-85rv too,
so its entry leaves the allow list in scripts/audit.mjs.

Only package-lock.json moves; nothing the extension ships changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit 8bda9ab431 into main

2026-10-31 12:40:38 +00:00

tiagoagueda deleted branch node-forge-1.4.2

2026-10-31 12:40:38 +00:00

tiagoagueda referenced this pull request from a commit

2026-10-31 12:40:40 +00:00

Take node-forge 1.4.2, which fixes four new high advisories in the dev chain (#55)