Conversation
There was a problem hiding this comment.
Pull request overview
This PR applies a security audit fix by upgrading the node-forge package from version 1.3.1 to 1.3.3 to address a known security vulnerability in versions prior to 1.3.2.
Key Changes
- Added pnpm override for
node-forge@<1.3.2to force minimum version^1.3.2 - Updated all
node-forgereferences in the lockfile from version 1.3.1 to 1.3.3 - Maintained consistency across 4 dependency snapshots in the lockfile
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Added pnpm override entry to force node-forge versions below 1.3.2 to upgrade to at least 1.3.2 |
| pnpm-lock.yaml | Updated all node-forge package references from 1.3.1 to 1.3.3, including package resolution and dependency snapshots for @expo/prebuild-config, @expo/code-signing-certificates, and selfsigned packages |
The changes are consistent and follow the established pattern for security-related dependency overrides in this codebase. The override correctly specifies that any node-forge version below 1.3.2 should be replaced with ^1.3.2, and pnpm has resolved this to the latest available patch version 1.3.3. All references in the lockfile have been updated consistently.
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
apply audit fix
Testing
N/A
Checklist
.changeset