Bump node-forge from 1.3.1 to 1.3.2 in /controlpanel

[dependabot]

Bumps node-forge from 1.3.1 to 1.3.2.

Changelog

Sourced from node-forge's changelog.

1.3.2 - 2025-11-25

Security

• HIGH: ASN.1 Validator Desynchronization
  • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
  • Reported by Hunter Wodzenski.
  • CVE ID: CVE-2025-12816
  • GHSA ID: GHSA-5gfm-wpxj-wjgq
• HIGH: ASN.1 Unbounded Recursion
  • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
  • Reported by Hunter Wodzenski.
  • CVE ID: CVE-2025-66031
  • GHSA ID: GHSA-554w-wpv2-vw27
• MODERATE: ASN.1 OID Integer Truncation
  • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
  • Reported by Hunter Wodzenski.
  • CVE ID: CVE-2025-66030
  • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

• [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
• [asn1] Add fromDer() max recursion depth check.
  • Add a asn1.maxDepth global configurable maximum depth of 256.
  • Add a asn1.fromDer() per-call maxDepth option.
  • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
  • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default maximum.
• [asn1] Improve OID handling.
  • Error on parsed OID values larger than 2**32 - 1.
  • Error on DER OID values larger than 2**53 - 1 .

Commits

• 235ad3e Release 1.3.2.
• 2598244 Update changelog.
• 0032dd0 Fix typos.
• d75e08d Run new security test.
• a5ce91d Update changelog formatting.
• 4652de6 Cleanups.
• eb932d9 Fix typo.
• db6954b Fix style.
• afbf7d8 Align error message style.
• 6607445 Revert minor changes.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[alexcos20]

@dependabot rebase

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, initiated by Dependabot, updates the node-forge dependency from version 1.3.1 to 1.3.2 within the controlpanel directory. This is a routine patch version bump, primarily affecting controlpanel/package-lock.json. Patch updates typically include bug fixes, performance improvements, and sometimes minor security fixes, with a low likelihood of introducing breaking changes.

Comments:
• [INFO][security] This is a patch version bump for node-forge, a critical cryptographic library. It's good practice to keep such dependencies updated. While low risk, it's always recommended to briefly check the upstream changelog for node-forge v1.3.2 to confirm there are no unexpected changes or known regressions that might affect our controlpanel application.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, opened by Dependabot, updates the node-forge dependency in the controlpanel directory. The package-lock.json indicates an update from version 1.3.1 to 1.3.3. The PR also includes several transitive dependency changes, notably adding multiple @parcel/watcher optional dependencies and removing utf-8-validate. This is a routine security and maintenance update.

Comments:
• [INFO][other] The PR title indicates an update to node-forge 1.3.2, but the package-lock.json shows it updated to 1.3.3. Please ensure that 1.3.3 is the intended target and, if so, update the PR title accordingly. This is likely due to Dependabot picking up a newer patch release during its run.
• [INFO][other] This update introduces several new optional @parcel/watcher-* native modules for various platforms (e.g., android-arm64, darwin-x64, linux-arm-glibc, win32-x64). These are likely transitive dependencies brought in by other updated packages. As they are optional, they should only be installed if the specific platform matches, so this change typically doesn't pose a direct risk for other environments.
• [INFO][other] The utf-8-validate package has been removed as a dependency. This indicates that it's no longer required by the updated dependency tree, which is a common occurrence during dependency bumps. No immediate concerns, but good to note the change.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the node-forge library from version 1.3.1 to 1.3.2 within the /controlpanel directory. This is a patch version bump for an indirect dependency, aiming to incorporate minor bug fixes.

Comments:
• [INFO][other] This Dependabot PR correctly updates node-forge from 1.3.1 to 1.3.2. As an indirect dependency and a patch release, the risk associated with this upgrade is minimal. The changelog for 1.3.2 indicates only bug fixes, primarily for RSA-PSS padding and BigInteger/util issues, which should not introduce breaking changes for indirect consumers.
• [INFO][other] While this is a low-risk patch update, it's always good practice to ensure that the CI/CD pipeline runs successfully and that all relevant unit and integration tests for the controlpanel module pass. This verifies that the dependency update hasn't introduced any unexpected regressions.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the node-forge dependency in the /controlpanel directory from version 1.3.1 to 1.3.3. This update is important as node-forge@1.3.2 and node-forge@1.3.3 contain critical security fixes for CVE-2022-0122 (denial-of-service) and CVE-2022-24792 (cryptographic side-channel vulnerability). The lock file also reflects the addition of several @parcel/watcher platform-specific optional dependencies and the removal of utf-8-validate, which are typical side-effects of package manager resolution during dependency updates.

Comments:
• [INFO][other] The PR title states bumping node-forge to 1.3.2, but the package-lock.json indicates an update to 1.3.3. Version 1.3.3 is a patch release on top of 1.3.2 and includes the security fixes from 1.3.2. This is generally an improvement, but it's good to be aware of the version discrepancy between the title and the actual dependency resolved.
• [INFO][performance] The utf-8-validate package, often an optional native dependency for WebSocket libraries like ws, has been removed. This module typically provides performance-optimized UTF-8 validation. Its removal means that a pure JavaScript fallback will be used instead. While this usually doesn't cause functional issues, it might introduce a minor performance overhead in scenarios where intensive UTF-8 validation is performed. Given this is for a control panel, the impact is likely negligible, but it's worth noting.
• [INFO][other] Several new platform-specific optional dependencies for @parcel/watcher have been added (e.g., for different OS and CPU architectures). These are likely a result of the package manager re-evaluating and expanding the dependency tree for existing packages during the update process. As these are optional and typically related to development/build tooling, they should not affect the production runtime of the controlpanel.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, initiated by Dependabot, updates the node-forge dependency from version 1.3.1 to 1.3.3 within the controlpanel directory. This is primarily a maintenance update to incorporate the latest bug fixes and minor improvements. The update also involves several changes to optional @parcel/watcher-* dependencies and the removal of utf-8-validate, which are common side effects of package-lock.json regeneration during dependency updates.

Comments:
• [INFO][other] The PR title indicates a bump to node-forge 1.3.2, but the package-lock.json updates it to 1.3.3. This is likely due to 1.3.3 being released between Dependabot creating the PR and generating the lockfile. Since 1.3.3 includes the changes from 1.3.2 and any subsequent patches, this is generally a positive outcome, ensuring the latest stable patch is used.
• [INFO][security] node-forge is a critical dependency often used for cryptographic operations. Keeping it updated to the latest patch version (1.3.3) is good practice for security and stability, as it typically includes bug fixes and minor security enhancements.
• [INFO][other] Numerous @parcel/watcher-* packages are added as optional dependencies, and utf-8-validate is removed. These are likely transitive changes resulting from the overall package-lock.json regeneration process. As they are optional dependencies, their addition/removal should not impact core functionality but rather reflect updates in the broader dependency tree.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the node-forge dependency in the /controlpanel directory. The package-lock.json reflects an update from version 1.3.1 to 1.3.3. This change also introduces several new optional platform-specific @parcel/watcher packages and removes the utf-8-validate optional dependency.

Comments:
• [INFO][other] The PR title states 'Bump node-forge from 1.3.1 to 1.3.2', however, the actual update in package-lock.json shows node-forge being bumped to version 1.3.3. Please clarify if this discrepancy is intentional (e.g., Dependabot picked up a newer version before merging) or if the title needs to be updated.
• [INFO][other] The optional dependency utf-8-validate has been removed. While typically harmless as it's an optional transitive dependency, it's worth a quick check to ensure that no part of the controlpanel explicitly or implicitly relied on its presence for specific functionalities (e.g., WebSocket optimizations).