From 2031b5a72254de99a907523ef06da2bcf62edfa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 2 Oct 2026 21:03:43 +0200 Subject: [PATCH] chore(deps): ignore the node-forge advisory until a fix is published GHSA-86w9-cpqp-85rv affects RSA PKCS#1 v1.5 signature verification in node-forge up to 1.4.0, which arrives only through @parse/node-apn for certificate-based APNs credentials. HealthLog uses token authentication, so that path never runs, and no patched release exists yet. --- pnpm-workspace.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index d1e045b06..a1304d0c1 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -110,3 +110,13 @@ minimumReleaseAgeExclude: - "@next/bundle-analyzer@16.2.12" - lucide-react@1.27.0 - undici@8.10.0 + +auditConfig: + ignoreGhsas: + # node-forge <=1.4.0, RSA PKCS#1 v1.5 signature verification. It arrives + # only through @parse/node-apn, which uses it for certificate-based APNs + # credentials (p12 / PEM certificate). HealthLog authenticates to APNs + # with a token (.p8 key, APNS_KEY_ID / APNS_TEAM_ID), so that code path + # never runs. No patched release is published yet (latest is 1.4.0); + # remove this entry and raise the floor once 1.4.1 is out. + - GHSA-86w9-cpqp-85rv