Skip to content

Bump node-forge from 1.3.3 to 1.4.0 in /frontend#170

Open
dependabot[bot] wants to merge 3 commits into
masterfrom
dependabot/npm_and_yarn/frontend/node-forge-1.4.0
Open

Bump node-forge from 1.3.3 to 1.4.0 in /frontend#170
dependabot[bot] wants to merge 3 commits into
masterfrom
dependabot/npm_and_yarn/frontend/node-forge-1.4.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 11, 2026 •
edited
Loading

Bumps node-forge from 1.3.3 to 1.4.0.

Changelog

Sourced from node-forge's changelog.

1.4.0 - 2026-03-24

Security

  • HIGH: Denial of Service in BigInteger.modInverse()
    • A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.
    • Reported by Kr0emer.
    • CVE ID: CVE-2026-33891
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.
    • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.
    • Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.
    • Reported as part of a U.C. Berkeley security research project by:
      • Austin Chu, Sohee Kim, and Corban Villa.
    • CVE ID: CVE-2026-33894
    • GHSA ID: GHSA-ppp5-5v6c-4jwp
  • HIGH: Signature forgery in Ed25519 due to missing S < L check.
    • Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.
    • Reported as part of a U.C. Berkeley security research project by:
      • Austin Chu, Sohee Kim, and Corban Villa.
    • CVE ID: CVE-2026-33895
    • GHSA ID: GHSA-q67f-28xg-22rw
  • HIGH: basicConstraints bypass in certificate chain verification.
    • pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
    • Reported by Doruk Tan Ozturk (@​peaktwilight) - doruk.ch
    • CVE ID: CVE-2026-33896
    • GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 11, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 11, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
mempool Ready Ready Preview, Comment May 11, 2026 7:22am

@snyk-io
Copy link
Copy Markdown

snyk-io Bot commented May 11, 2026 •
edited
Loading

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
🔚 Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@Dargon789 @gemini-code-assist
@github-advanced-security @sourcery-ai @googleworkspace-bot @vercel
updated demo redirect handling (#164)
12bee27 
* Create cargo.yml (#31)

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

* Create web3_defi_gamefi.yml (#33)

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

* Create SECURITY.md (#34)

* Create SECURITY.md

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

* Update SECURITY.md

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

---------

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

* Create static.yml (#36)

* Summary by Sourcery
Add a new GitHub Actions workflow to build and deploy static content to GitHub Pages.

CI:

Create .github/workflows/static.yml to trigger deployments on pushes to main and manual dispatch
Configure permissions for GITHUB_TOKEN and set concurrency to avoid canceling in-progress runs
Define a deploy job that checks out the repo, configures Pages, uploads the site artifact, and deploys to GitHub Pages

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

* Potential fix for code scanning alert no. 33: Client-side cross-site scripting (#39)

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 8: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

* Update .circleci/web3_defi_gamefi.yml

Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Client-side cross-site scripting'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Replacement of a substring with itself'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

* Install Vercel Web Analytics (#167)

## Vercel Web Analytics Integration

Successfully configured Vercel Web Analytics for the mempool Angular application.

### Changes Made:

#### 1. Created New File:
- **frontend/src/app/services/analytics.service.ts** - New Angular service to initialize Vercel Analytics
  - Implements proper environment-aware configuration
  - Uses `inject()` function from `@vercel/analytics` package
  - Automatically switches between 'production' and 'development' modes based on environment configuration

#### 2. Modified Files:
- **frontend/src/app/app.module.ts** - Added AnalyticsService to the providers array
- **frontend/src/app/components/app/app.component.ts** - Injected AnalyticsService into the root component to ensure it initializes on app startup
- **frontend/package.json** - Added @vercel/analytics ^2.0.1 to dependencies (was already present, order normalized)
- **frontend/package-lock.json** - Updated lock file to reflect dependency tree

### Implementation Details:

The implementation follows best practices for Angular applications:

1. **Service-Based Architecture**: Created a dedicated `AnalyticsService` that encapsulates the Vercel Analytics initialization logic
2. **Environment-Aware Configuration**: The service automatically detects whether the app is running in production or development mode and configures analytics accordingly
3. **Singleton Pattern**: The service uses `providedIn: 'root'` to ensure a single instance across the application
4. **Early Initialization**: The service is injected into the root `AppComponent` to ensure analytics are initialized as early as possible in the application lifecycle

### Technical Approach:

Since Vercel Analytics doesn't have specific Angular instructions in their documentation, I used their vanilla JavaScript/TypeScript approach with the `inject()` function. This is the recommended pattern for frameworks without dedicated integrations.

The configuration passes a `mode` parameter to control whether analytics run in development or production mode:
- **Production mode**: Full analytics tracking enabled
- **Development mode**: Analytics can be tested without affecting production data

### Verification:

- ✅ TypeScript compilation passes without errors
- ✅ Linter runs successfully with no new errors introduced
- ✅ Package is properly installed (@vercel/analytics@2.0.1)
- ✅ Service is properly registered in Angular's dependency injection system

### Next Steps:

To enable Web Analytics on Vercel:
1. Navigate to your Vercel dashboard
2. Select the project
3. Go to the Analytics section
4. Click "Enable" to activate Web Analytics
5. Deploy the application to see analytics data

The analytics will automatically start tracking page views and web vitals once the application is deployed and the feature is enabled in the Vercel dashboard.

Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>

---------

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
Co-authored-by: googleworkspace-bot <googleworkspace-bot@google.com>
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
@dependabot dependabot Bot changed the base branch from master to main May 11, 2026 07:17
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/node-forge-1.4.0 branch from d0dc569 to 2778482 Compare May 11, 2026 07:17
Dargon789 and others added 2 commits May 11, 2026 14:35
@Dargon789 @gemini-code-assist
Update frontend/src/app/services/analytics.service.ts
6f5595a 
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
@dependabot
Bump node-forge from 1.3.3 to 1.4.0 in /frontend
bf6e599 
Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.3 to 1.4.0.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.3...v1.4.0)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the base branch from main to master May 11, 2026 07:36
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/node-forge-1.4.0 branch from 2778482 to bf6e599 Compare May 11, 2026 07:36
@vercel
Copy link
Copy Markdown

vercel Bot commented May 11, 2026

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/dargon789-forge?upgradeToPro=build-rate-limit

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Dargon789