Skip to content

chore(deps): bump node-forge, ipfs and parcel #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): bump node-forge, ipfs and parcel #21

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 27, 2025

Bumps node-forge to 1.3.2 and updates ancestor dependencies node-forge, ipfs and parcel. These dependencies need to be updated together.

Updates node-forge from 0.7.6 to 1.3.2

Changelog

Sourced from node-forge's changelog.

1.3.2 - 2025-11-25

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
    • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default maximum.
  • [asn1] Improve OID handling.
    • Error on parsed OID values larger than 2**32 - 1.
    • Error on DER OID values larger than 2**53 - 1 .

1.3.1 - 2022-03-29

... (truncated)

Commits

Updates ipfs from 0.36.4 to 0.66.1

Release notes

Sourced from ipfs's releases.

ipfs ipfs-v0.66.1

Bug Fixes

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • ipfs-cli bumped from ^0.16.0 to ^0.16.1
      • ipfs-core bumped from ^0.18.0 to ^0.18.1
    • devDependencies
      • interface-ipfs-core bumped from ^0.158.0 to ^0.158.1
      • ipfs-client bumped from ^0.10.0 to ^0.10.1
      • ipfs-core-types bumped from ^0.14.0 to ^0.14.1
      • ipfs-http-client bumped from ^60.0.0 to ^60.0.1

ipfs ipfs-v0.66.0

⚠ BREAKING CHANGES

  • update multiformats to v11.x.x and related depenendcies (#4277)

Bug Fixes

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • ipfs-cli bumped from ^0.15.0 to ^0.16.0
      • ipfs-core bumped from ^0.17.0 to ^0.18.0
    • devDependencies
      • interface-ipfs-core bumped from ^0.157.0 to ^0.158.0
      • ipfs-client bumped from ^0.9.2 to ^0.10.0
      • ipfs-core-types bumped from ^0.13.0 to ^0.14.0
      • ipfs-http-client bumped from ^59.0.0 to ^60.0.0

ipfs ipfs-v0.65.0

See the upgrade guide.

⚠ BREAKING CHANGES

... (truncated)

Commits

Updates parcel from 1.12.3 to 2.16.1

Release notes

Sourced from parcel's releases.

v2.16.1

Fixed

  • JavaScript

    • Fix macro location information – Details

  • React Server Components Improve performance of RSC builds – Details

v2.16.0

This release significantly improves code splitting and tree shaking when scope hoisting is disabled, e.g. when using React Server Components with static rendering. It enables re-exports to be followed when resolving a dependency, so that only used exports from large libraries get bundled together for each page rather than across all pages. This was already the case when using scope hoisting, but now it works without scope hoisting as well.

Added

  • JavaScript
    • Code split re-exports when scope hoisting is disabled – Details

Fixed

  • JavaScript
    • Scope macro asset unique keys to the parent asset – Details

v2.15.3

Fixed

  • JavaScript

    • Expose line and column number to macros – Details

  • React Server Components

    • Invalidate cache in ReactStaticPackager when pages are added or client components change – Details
    • Fix lazy mode with React Server Components – Details
    • Fix @parcel/rsc duplicate types – Details
    • Ensure publicUrl ends with a slash in react-static packager – Details
    • Fix hash reference replacement in react-static packager – Details

v2.15.2

  • Core

    • Change minimum required glibc version to 2.26 – Details
    • Cache inline bundle packaging – Details
    • Use stable id for package requests – Details

  • HTML

    • Do not remove <meta charset="utf-8"> – Details

  • MDX

    • Make URL dependencies in MDX files optional – Details

  • React Server Components

    • Fix memory leak in react-static packager – Details

  • Resolver

    • Fix resolving source package exports condition from self reference – Details

  • SVG

... (truncated)

Changelog

Sourced from parcel's changelog.

[2.16.1] – 2025-11-04

Fixed

  • JavaScript

    • Fix macro location information – Details

  • React Server Components Improve performance of RSC builds – Details

[2.16.0] – 2025-09-18

Added

  • JavaScript
    • Code split re-exports when scope hoisting is disabled – Details

Fixed

  • JavaScript
    • Scope macro asset unique keys to the parent asset – Details

[2.15.3] – 2025-06-20

Fixed

  • JavaScript

    • Expose line and column number to macros – Details

  • React Server Components

    • Invalidate cache in ReactStaticPackager when pages are added or client components change – Details
    • Fix lazy mode with React Server Components – Details
    • Fix @parcel/rsc duplicate types – Details
    • Ensure publicUrl ends with a slash in react-static packager – Details
    • Fix hash reference replacement in react-static packager – Details

[2.15.2] - 2025-05-24

Fixed

  • Core

    • Change minimum required glibc version to 2.26 – Details
    • Cache inline bundle packaging – Details
    • Use stable id for package requests – Details

  • HTML

    • Do not remove <meta charset="utf-8"> – Details

  • MDX

    • Make URL dependencies in MDX files optional – Details

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump node-forge, ipfs and parcel
915c835 
Bumps [node-forge](https://github.com/digitalbazaar/forge) to 1.3.2 and updates ancestor dependencies [node-forge](https://github.com/digitalbazaar/forge), [ipfs](https://github.com/ipfs/js-ipfs) and [parcel](https://github.com/parcel-bundler/parcel). These dependencies need to be updated together.


Updates `node-forge` from 0.7.6 to 1.3.2
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@0.7.6...v1.3.2)

Updates `ipfs` from 0.36.4 to 0.66.1
- [Release notes](https://github.com/ipfs/js-ipfs/releases)
- [Changelog](https://github.com/ipfs/js-ipfs/blob/master/CHANGELOG.md)
- [Commits](ipfs/js-ipfs@v0.36.4...ipfs-v0.66.1)

Updates `parcel` from 1.12.3 to 2.16.1
- [Release notes](https://github.com/parcel-bundler/parcel/releases)
- [Changelog](https://github.com/parcel-bundler/parcel/blob/v2/CHANGELOG.md)
- [Commits](https://github.com/parcel-bundler/parcel/compare/parcel-bundler@1.12.3...v2.16.1)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.3.2
  dependency-type: indirect
- dependency-name: ipfs
  dependency-version: 0.66.1
  dependency-type: direct:production
- dependency-name: parcel
  dependency-version: 2.16.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant