From bcf411f38b98eaefcf503a0746ada9d403c82ffc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <marc@bombeck.io>
Date: Wed, 11 Nov 2026 00:14:35 +0100
Subject: [PATCH] chore(deps): move node-forge to 1.4.3

The override in pnpm-workspace.yaml now floors node-forge at 1.4.3, which
clears the five advisories against 1.4.2 and leaves pnpm audit --prod
clean. It arrives only under @parse/node-apn, which pins 1.4.2 exactly;
the APNs sender uses token auth, so the certificate path never runs.
---
 CHANGELOG.md        |  7 +++++++
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml |  9 ++++++---
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c975a114..6065a7d78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -101,6 +101,13 @@
   could be lost to the new link. Turning it off now wins whichever comes
   first, and the change lands on the link that stays live.
 
+### Security
+
+- `node-forge` moves to 1.4.3, which fixes five advisories in certificate
+  chain checks, signatures and TLS handling. It arrives only under the APNs
+  library, and HealthLog signs push requests with a token key, so none of
+  that code runs; the update keeps the dependency audit clean.
+
 ## [1.47.1] — 2026-11-07
 
 ### Added
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 52e9fed64..f1d037f37 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -37,7 +37,7 @@ overrides:
   brace-expansion@>=4.0.0 <5.0.12: ^5.0.12
   undici@>=7.0.0 <7.30.1: ^7.30.1
   vite@>=8.0.0 <8.1.6: ^8.1.6
-  node-forge@<1.4.2: ^1.4.2
+  node-forge@<1.4.3: ^1.4.3
 
 patchedDependencies:
   '@stryker-mutator/vitest-runner@10.0.0': 9ad3e9855fd9781fd36e872ed42c5f934f91b962d6830e6cc56d56bf16e1dabd
@@ -5559,8 +5559,8 @@ packages:
       encoding:
         optional: true
 
-  node-forge@1.4.2:
-    resolution: {integrity: sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==}
+  node-forge@1.4.3:
+    resolution: {integrity: sha512-P6wzfh6t70avmV8FrVEAd/36sOPJQ+hkaJVX1Laap9J/77m7M0eyozDvc8SwnDf4P7MP94gwbAAo0rg3YVXT+g==}
     engines: {node: '>= 6.13.0'}
 
   node-releases@2.0.58:
@@ -8653,7 +8653,7 @@ snapshots:
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       jsonwebtoken: 9.0.3
-      node-forge: 1.4.2
+      node-forge: 1.4.3
       verror: 1.10.1
     transitivePeerDependencies:
       - supports-color
@@ -12760,7 +12760,7 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-forge@1.4.2: {}
+  node-forge@1.4.3: {}
 
   node-releases@2.0.58: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 0d63e5b6d..24ae01c43 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -114,9 +114,12 @@ overrides:
   "vite@>=8.0.0 <8.1.6": "^8.1.6"
   # GHSA-86w9-cpqp-85rv, GHSA-7wch-p9px-956x, GHSA-jc66-7q78-782g,
   # GHSA-8hrf-8g6f-7xwp, GHSA-hqq3-7jhf-c5jx, GHSA-5x38-2vff-x55p: signature,
-  # certificate-chain and TLS-record flaws in node-forge <= 1.4.0. It arrives
-  # only through @parse/node-apn; 1.4.2 is the release node-apn 8.1.1 pins.
-  "node-forge@<1.4.2": "^1.4.2"
+  # certificate-chain and TLS-record flaws in node-forge <= 1.4.0;
+  # GHSA-3cc4-3294-vgjf, GHSA-6889-vf6x-f3g5, GHSA-w4xr-hqv8-ch44,
+  # GHSA-6cv4-p8m7-4r25 and GHSA-j8rw-jp99-435v in <= 1.4.2. It arrives only
+  # through @parse/node-apn, which pins 1.4.2 exactly; the app signs APNs
+  # requests with a token key and never reaches its certificate path.
+  "node-forge@<1.4.3": "^1.4.3"
 
 allowBuilds:
   "@prisma/engines": true