Skip to content

DBX-6749 chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /dbml-homepage#787

Merged
huydo862003 merged 2 commits intomasterfrom
dependabot/npm_and_yarn/dbml-homepage/node-forge-1.3.3
Apr 13, 2026
Merged

DBX-6749 chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /dbml-homepage#787
huydo862003 merged 2 commits intomasterfrom
dependabot/npm_and_yarn/dbml-homepage/node-forge-1.3.3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Dec 3, 2025

Bumps node-forge from 1.3.1 to 1.3.3.

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

  • [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
    • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default

... (truncated)

Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 3, 2025
@huydo862003 huydo862003 added the PR: Internal 🏡 A type of pull request used for changelog categories label Apr 13, 2026
@huydo862003
Copy link
Copy Markdown
Contributor

@dependabot rebase

@huydo862003
Copy link
Copy Markdown
Contributor

#DBX-6745

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.1 to 1.3.3.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.1...v1.3.3)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.3.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/dbml-homepage/node-forge-1.3.3 branch from 22a4bb9 to 24ba1cf Compare April 13, 2026 03:40
@huydo862003 huydo862003 changed the title chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /dbml-homepage DBX-6745 chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /dbml-homepage Apr 13, 2026
@linear
Copy link
Copy Markdown

linear Bot commented Apr 13, 2026

@huydo862003 huydo862003 force-pushed the dependabot/npm_and_yarn/dbml-homepage/node-forge-1.3.3 branch from d74705f to 24ba1cf Compare April 13, 2026 03:46
@huydo862003 huydo862003 merged commit c22966f into master Apr 13, 2026
5 checks passed
@huydo862003 huydo862003 deleted the dependabot/npm_and_yarn/dbml-homepage/node-forge-1.3.3 branch April 13, 2026 03:48
@github-actions
Copy link
Copy Markdown

Coverage Report

Commit: df28c68

Overall Coverage

Metric Coverage
Lines ✅ 84.13% (5793/6886)
Statements ✅ 83.30% (6181/7420)
Functions ✅ 88.96% (1329/1494)
Branches ⚠️ 75.11% (3208/4271)

Package Coverage

Package Lines Statements Functions Branches
@dbml/dbml-cli ✅ 100.00% ✅ 100.00% ✅ 100.00% ✅ 100.00%
@dbml/dbml-connector ⚠️ 64.62% ⚠️ 64.36% ⚠️ 59.53% ⚠️ 59.09%
@dbml/dbml-core N/A N/A N/A N/A
@dbml/dbml-parse ✅ 87.23% ✅ 86.28% ✅ 92.80% ⚠️ 77.39%

⚠️ Coverage Warnings

The following packages have coverage below 80%:

  • @dbml/dbml-connector: 64.62% line coverage

Files with Coverage Below 80%

@dbml/dbml-connector

9 file(s) below 80% coverage
File Lines Statements Functions Branches
src/connectors/bigquery/index.ts 0.00% 0.00% 0.00% 0.00%
src/utils/credential-loader.ts 0.00% 0.00% 0.00% 0.00%
src/utils/helpers.ts 0.00% 0.00% 0.00% 0.00%
src/connectors/snowflake/index.ts 10.56% 10.31% 0.00% 0.00%
src/utils/parseSchema.ts 46.15% 42.85% 28.57% 27.27%
src/connectors/connector.ts 66.66% 66.66% 100.00% 57.14%
src/connectors/oracle/tables.ts 71.25% 67.39% 100.00% 56.96%
src/connectors/oracle/index.ts 80.00% 80.76% 100.00% 25.00%
src/connectors/oracle/utils.ts 85.71% 85.71% 100.00% 71.42%

@dbml/dbml-parse

41 file(s) below 80% coverage
File Lines Statements Functions Branches
src/compiler/queries/container/scope.ts 0.00% 0.00% 0.00% 100.00%
src/services/diagnostics/provider.ts 0.00% 0.00% 0.00% 0.00%
src/core/analyzer/symbol/utils.ts 44.82% 44.82% 100.00% 38.46%
src/core/interpreter/elementInterpreter/project.ts 51.42% 51.42% 100.00% 36.36%
src/core/interpreter/records/utils/data/sqlTypes.ts 56.25% 58.82% 75.00% 46.55%
src/core/analyzer/binder/elementBinder/note.ts 62.50% 64.70% 83.33% 50.00%
src/core/analyzer/binder/elementBinder/diagramView.ts 64.47% 65.85% 76.00% 51.51%
src/compiler/queries/utils.ts 64.83% 65.95% 88.88% 47.43%
src/core/interpreter/records/utils/data/values.ts 65.13% 57.14% 72.72% 50.37%
src/compiler/queries/parse.ts 66.66% 66.66% 66.66% 100.00%
src/compiler/queries/token.ts 66.66% 66.66% 66.66% 100.00%
src/core/analyzer/validator/elementValidators/indexes.ts 71.42% 72.28% 90.90% 57.40%
src/core/analyzer/binder/elementBinder/enum.ts 72.22% 73.68% 100.00% 62.50%
src/core/analyzer/symbol/symbolIndex.ts 73.91% 74.46% 93.75% 42.85%
src/core/analyzer/analyzer.ts 75.00% 66.66% 60.00% 100.00%
src/core/analyzer/validator/elementValidators/note.ts 75.92% 74.13% 76.92% 73.52%
src/core/analyzer/validator/elementValidators/project.ts 76.47% 77.14% 100.00% 55.55%
src/core/analyzer/validator/elementValidators/checks.ts 76.78% 78.33% 93.75% 70.58%
src/core/analyzer/validator/elementValidators/records.ts 77.33% 77.92% 93.75% 73.43%
src/core/analyzer/utils.ts 77.77% 76.36% 88.88% 75.24%
src/core/analyzer/binder/elementBinder/project.ts 77.77% 78.94% 100.00% 50.00%
src/core/utils.ts 78.57% 77.41% 80.00% 60.71%
src/core/analyzer/binder/elementBinder/ref.ts 78.78% 80.00% 90.90% 75.00%
src/core/analyzer/binder/elementBinder/indexes.ts 79.06% 77.77% 90.90% 68.18%
src/core/analyzer/binder/elementBinder/tableGroup.ts 80.00% 80.64% 100.00% 50.00%
src/compiler/queries/transform/syncDiagramView.ts 80.43% 73.83% 75.00% 69.23%
src/core/interpreter/records/utils/constraints/pk.ts 82.00% 81.53% 92.30% 59.09%
src/services/suggestions/utils.ts 82.35% 76.78% 92.85% 70.37%
src/core/analyzer/binder/elementBinder/records.ts 82.79% 83.33% 93.75% 71.42%
src/core/analyzer/validator/elementValidators/tablePartial.ts 83.04% 80.41% 87.23% 64.10%
src/compiler/queries/container/token.ts 83.33% 85.71% 100.00% 75.00%
src/core/analyzer/validator/elementValidators/diagramView.ts 84.69% 80.95% 85.00% 72.00%
src/core/parser/parser.ts 84.95% 85.12% 98.07% 77.61%
src/core/analyzer/binder/elementBinder/tablePartial.ts 86.00% 86.53% 100.00% 69.23%
src/core/interpreter/elementInterpreter/diagramView.ts 87.91% 83.96% 70.00% 68.42%
src/services/suggestions/recordRowSnippet.ts 88.67% 84.61% 100.00% 78.00%
__tests__/utils/compiler.ts 90.19% 90.14% 100.00% 68.08%
src/compiler/queries/symbol.ts 91.30% 92.00% 100.00% 78.57%
src/core/interpreter/elementInterpreter/sticky_note.ts 95.00% 95.23% 100.00% 66.66%
src/core/analyzer/symbol/symbolTable.ts 100.00% 100.00% 100.00% 75.00%
src/services/definition/provider.ts 100.00% 100.00% 100.00% 75.00%

@huydo862003 huydo862003 changed the title DBX-6745 chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /dbml-homepage DBX-6749 chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /dbml-homepage Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code PR: Internal 🏡 A type of pull request used for changelog categories

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant