fix: bump transient dependency node-forge for cve vulnerabilities

[Will-ShaoHua]

Problem

node-forge (affected version 1.3.1) found in package-lock.json:

CVE-2025-12816 → Fixed in dependency version: v1.3.2
CVE-2025-66031 → Fixed in dependency version: v1.3.2

(base) ➜  language-server-runtimes git:(cve) npm i
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: cosmiconfig-typescript-loader@6.1.0
npm warn Found: @types/node@22.15.17
npm warn node_modules/@types/node
npm warn   dev @types/node@"^22.15.17" from the root project
npm warn   4 more (@types/mock-fs, @types/node-forge, protobufjs, @aws/language-server-runtimes)
npm warn
npm warn Could not resolve dependency:
npm warn peer @types/node@"*" from cosmiconfig-typescript-loader@6.1.0
npm warn node_modules/cosmiconfig-typescript-loader
npm warn   cosmiconfig-typescript-loader@"^6.1.0" from @commitlint/load@19.8.1
npm warn   node_modules/@commitlint/load
> @amzn/monorepo-language-server-runtimes@1.0.0 prepare
> husky .husky
added 1 package, removed 53 packages, and audited 366 packages in 2s
70 packages are looking for funding
  run `npm fund` for details

2 vulnerabilities (1 moderate, 1 high)
To address all issues, run:
  npm audit fix
Run `npm audit` for details.

(base) ➜  language-server-runtimes git:(cve) npm list node-forge --all
@amzn/monorepo-language-server-runtimes@1.0.0 /Volumes/workplace/ide/language-server-runtimes
└─┬ @aws/language-server-runtimes@0.3.10 -> ./runtimes
  ├─┬ mac-ca@3.1.1
  │ └── node-forge@1.3.1 deduped
  ├── node-forge@1.3.1
  └─┬ win-ca@3.5.1
    └── node-forge@1.3.1 deduped

Solution

(base) ➜  language-server-runtimes git:(cve) npm audit fix
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: cosmiconfig-typescript-loader@6.1.0
npm warn Found: @types/node@22.15.17
npm warn node_modules/@types/node
npm warn   dev @types/node@"^22.15.17" from the root project
npm warn   4 more (@types/mock-fs, @types/node-forge, protobufjs, @aws/language-server-runtimes)
npm warn
npm warn Could not resolve dependency:
npm warn peer @types/node@"*" from cosmiconfig-typescript-loader@6.1.0
npm warn node_modules/cosmiconfig-typescript-loader
npm warn   cosmiconfig-typescript-loader@"^6.1.0" from @commitlint/load@19.8.1
npm warn   node_modules/@commitlint/load

changed 2 packages, and audited 366 packages in 2s

70 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

(base) ➜  language-server-runtimes git:(cve) ✗ npm list node-forge
@amzn/monorepo-language-server-runtimes@1.0.0 /Volumes/workplace/ide/language-server-runtimes
└─┬ @aws/language-server-runtimes@0.3.10 -> ./runtimes
  ├─┬ mac-ca@3.1.1
  │ └── node-forge@1.3.3 deduped
  ├── node-forge@1.3.3
  └─┬ win-ca@3.5.1
    └── node-forge@1.3.3 deduped

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.