Skip to content

Conversation

@esarafianou
Copy link
Contributor

Description

Updates node-forge to the latest version to address a security issue in the dependency and bumps a new version. Fixes #75

The node-forge new version drops support for node 4 but node-xml-encryption already specifies the node engine >=8. As such, a new patch version will be released.

References

https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677

Testing

All tests pass successfully.

  • This change adds test coverage for new/changed/fixed functionality

Checklist

  • I have added documentation for new/changed functionality in this PR or in auth0.com/docs
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used, if not master

@esarafianou esarafianou requested a review from a team as a code owner September 8, 2020 18:00
Copy link
Contributor

@gkwang gkwang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wait, why did the package-lock got changed to http?

@esarafianou
Copy link
Contributor Author

@gkwang Not sure what went wrong with the npm install but I updated it now.

@esarafianou esarafianou merged commit f412aac into master Sep 9, 2020
@esarafianou esarafianou deleted the update_forge branch September 9, 2020 07:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants