search

appfeel / node-pushnotifications

Push notifications for GCM, APNS, MPNS, AMZ (automatic detection from device token)
MIT License
544 stars 125 forks source link

Update node-forge to fix security vulnerabilities #172

Closed davidschuette closed 2 years ago

davidschuette commented 2 years ago

I use the latest version of node-pushnotifications in a project of mine.

I recently found out that the currently used version of node-forge has a number of security issues. Is there any possibility of an upgrade to fix these vulnerablities?

All the issues have been patched in version >= 1.3.0.

alex-friedl commented 2 years ago

I opened an issue with @parse/node-apn and asked them to look into updating the version they are using: https://github.com/parse-community/node-apn/issues/103

davidschuette commented 2 years ago

Thank you.

tommyvigneaultdev commented 2 years ago

Seems @parse/node-apn released version 5.1.3 with the fix. All that's left to do is to upgrade the dependency here.