build(deps): bump node-forge and @angular-devkit/build-angular #1295

dependabot · 2026-01-19T08:04:35Z

Bumps node-forge to 1.3.3 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates node-forge from 0.10.0 to 1.3.3

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

[pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

HIGH: ASN.1 Validator Desynchronization

An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Reported by Hunter Wodzenski.

CVE ID: CVE-2025-12816

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: ASN.1 Unbounded Recursion

An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.

Reported by Hunter Wodzenski.

CVE ID: CVE-2025-66031

GHSA ID: GHSA-554w-wpv2-vw27

MODERATE: ASN.1 OID Integer Truncation

An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.

Reported by Hunter Wodzenski.

CVE ID: CVE-2025-66030

GHSA ID: GHSA-65ch-62r8-g69g

Fixed

[asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.

[asn1] Add fromDer() max recursion depth check.

Add a asn1.maxDepth global configurable maximum depth of 256.

Add a asn1.fromDer() per-call maxDepth option.

NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.

NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default

... (truncated)

Commits

1cea0af Release 1.3.3.
5265989 Update changelog.
e4f3961 Fix changelog for release.
503979b Update changelog.
c3b3b32 Make digestAlgorithm parameters optional
6f70043 Update CVE details.
f547b0d Start 1.3.3-0.
235ad3e Release 1.3.2.
2598244 Update changelog.
0032dd0 Fix typos.
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 0.1100.1 to 21.1.0

Release notes

Sourced from @angular-devkit/build-angular's releases.

21.1.0

@schematics/angular

Commit Description

add browserMode option to jasmine-vitest schematic

generate detailed migration report for refactor-jasmine-vitest

add MCP configuration file to new workspaces

@angular/cli

Commit Description

add 'test' and 'e2e' MCP tools

Add "all" as an experimental tool group

Add MCP tools for building and running devservers

add signal forms lessons

correctly handle yarn classic tag manifest fetching

correctly spawn package managers on Windows in new abstraction

enhance list_projects MCP tool file system traversal and symlink handling

handle array output from npm view in manifest parser

improve signal forms lesson examples in AI tutor

rename mcp devserver tools to comply with naming spec

update dependency @modelcontextprotocol/sdk to v1.25.2

update yarn berry package manager configuration

use project-local temporary directory in ng add

cache resolved specific version in package manager abstraction

optimize ng add version discovery

@angular/build

Commit Description

directly support ng-packagr in unit-test builder

disable TestBed teardown during debugging in Vitest

inject source-map-support for Vitest browser tests

normalize roots to POSIX in test discovery for Windows compatibility

resolve test files correctly on Windows when using non-C drives

simplify SSL handling for ng serve with SSR (#31722)

21.1.0-rc.0

@schematics/angular

Commit Description

move 'provideZoneChangeDetection' to the root module

update application schematics for module-based apps to use 'provideZoneChangeDetection'

update default app component message

update default app component welcome message

@angular/cli

Commit Description

add 'test' and 'e2e' MCP tools

Add "all" as an experimental tool group

handle array output from npm view in manifest parser

update dependency @modelcontextprotocol/sdk to v1.25.2

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

21.1.0 (2026-01-14)

@angular/cli

Commit Type Description

772e6efe7 feat add 'test' and 'e2e' MCP tools

8efb86318 feat Add "all" as an experimental tool group

c3c9ac506 feat Add MCP tools for building and running devservers

d635a6c63 feat add signal forms lessons

d8b76e93d fix correctly handle yarn classic tag manifest fetching

7ab5c0b0a fix correctly spawn package managers on Windows in new abstraction

348096623 fix enhance list_projects MCP tool file system traversal and symlink handling

316fca862 fix handle array output from npm view in manifest parser

032257a6d fix improve signal forms lesson examples in AI tutor

18d74dde8 fix rename mcp devserver tools to comply with naming spec

1ad773671 fix update dependency @modelcontextprotocol/sdk to v1.25.2

45d4f5668 fix update yarn berry package manager configuration

122ed27c9 fix use project-local temporary directory in ng add

a15db28b2 perf cache resolved specific version in package manager abstraction

240588b7e perf optimize ng add version discovery

@schematics/angular

Commit Type Description

36cf3afb4 feat add browserMode option to jasmine-vitest schematic

e71a72ffd feat generate detailed migration report for refactor-jasmine-vitest

18cf6c51b fix add MCP configuration file to new workspaces

@angular/build

Commit Type Description

1eda0a99f feat directly support ng-packagr in unit-test builder

87175f9dc feat disable TestBed teardown during debugging in Vitest

1e39c77a4 fix inject source-map-support for Vitest browser tests

3fd7dcd76 fix normalize roots to POSIX in test discovery for Windows compatibility

164e7dbbc fix resolve test files correctly on Windows when using non-C drives

ad99e00ad fix simplify SSL handling for ng serve with SSR (#31722)

21.0.6 (2026-01-14)

@angular/ssr

| Commit | Type | Description |

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [node-forge](https://github.com/digitalbazaar/forge) to 1.3.3 and updates ancestor dependency [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `node-forge` from 0.10.0 to 1.3.3 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@0.10.0...v1.3.3) Updates `@angular-devkit/build-angular` from 0.1100.1 to 21.1.0 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular-cli/commits/v21.1.0) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.3.3 dependency-type: indirect - dependency-name: "@angular-devkit/build-angular" dependency-version: 21.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 19, 2026

dependabot bot mentioned this pull request Jan 19, 2026

build(deps): bump node-forge and @angular-devkit/build-angular #1055

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump node-forge and @angular-devkit/build-angular #1295

build(deps): bump node-forge and @angular-devkit/build-angular #1295

Uh oh!

dependabot bot commented on behalf of github Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Commit	Description
	add browserMode option to jasmine-vitest schematic
	generate detailed migration report for `refactor-jasmine-vitest`
	add MCP configuration file to new workspaces

Commit	Description
	add 'test' and 'e2e' MCP tools
	Add "all" as an experimental tool group
	Add MCP tools for building and running devservers
	add signal forms lessons
	correctly handle yarn classic tag manifest fetching
	correctly spawn package managers on Windows in new abstraction
	enhance list_projects MCP tool file system traversal and symlink handling
	handle array output from npm view in manifest parser
	improve signal forms lesson examples in AI tutor
	rename mcp devserver tools to comply with naming spec
	update dependency `@modelcontextprotocol/sdk` to v1.25.2
	update yarn berry package manager configuration
	use project-local temporary directory in ng add
	cache resolved specific version in package manager abstraction
	optimize `ng add` version discovery

Commit	Description
	directly support ng-packagr in unit-test builder
	disable TestBed teardown during debugging in Vitest
	inject source-map-support for Vitest browser tests
	normalize roots to POSIX in test discovery for Windows compatibility
	resolve test files correctly on Windows when using non-C drives
	simplify SSL handling for `ng serve` with SSR (#31722)

Commit	Description
	move 'provideZoneChangeDetection' to the root module
	update application schematics for module-based apps to use 'provideZoneChangeDetection'
	update default app component message
	update default app component welcome message

Commit	Type	Description
772e6efe7	feat	add 'test' and 'e2e' MCP tools
8efb86318	feat	Add "all" as an experimental tool group
c3c9ac506	feat	Add MCP tools for building and running devservers
d635a6c63	feat	add signal forms lessons
d8b76e93d	fix	correctly handle yarn classic tag manifest fetching
7ab5c0b0a	fix	correctly spawn package managers on Windows in new abstraction
348096623	fix	enhance list_projects MCP tool file system traversal and symlink handling
316fca862	fix	handle array output from npm view in manifest parser
032257a6d	fix	improve signal forms lesson examples in AI tutor
18d74dde8	fix	rename mcp devserver tools to comply with naming spec
1ad773671	fix	update dependency `@modelcontextprotocol/sdk` to v1.25.2
45d4f5668	fix	update yarn berry package manager configuration
122ed27c9	fix	use project-local temporary directory in ng add
a15db28b2	perf	cache resolved specific version in package manager abstraction
240588b7e	perf	optimize `ng add` version discovery

Commit	Type	Description
36cf3afb4	feat	add browserMode option to jasmine-vitest schematic
e71a72ffd	feat	generate detailed migration report for `refactor-jasmine-vitest`
18cf6c51b	fix	add MCP configuration file to new workspaces

Commit	Type	Description
1eda0a99f	feat	directly support ng-packagr in unit-test builder
87175f9dc	feat	disable TestBed teardown during debugging in Vitest
1e39c77a4	fix	inject source-map-support for Vitest browser tests
3fd7dcd76	fix	normalize roots to POSIX in test discovery for Windows compatibility
164e7dbbc	fix	resolve test files correctly on Windows when using non-C drives
ad99e00ad	fix	simplify SSL handling for `ng serve` with SSR (#31722)

build(deps): bump node-forge and @angular-devkit/build-angular #1295

Are you sure you want to change the base?

build(deps): bump node-forge and @angular-devkit/build-angular #1295

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 19, 2026

1.3.3 - 2025-12-02

Fixed

1.3.2 - 2025-11-25

Security

Fixed

21.1.0

@​schematics/angular

@​angular/cli

@​angular/build

21.1.0-rc.0

@​schematics/angular

@​angular/cli

21.1.0 (2026-01-14)

@​angular/cli

@​schematics/angular

@​angular/build

21.0.6 (2026-01-14)

@​angular/ssr

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`@schematics/angular`

`@angular/cli`

`@angular/build`

`@schematics/angular`

`@angular/cli`

`@angular/cli`

`@schematics/angular`

`@angular/build`

`@angular/ssr`