[amyevans]

Explanation of Change

Updates node-forge from 1.3.1 to 1.4.2 in example/package-lock.json. This closes all 11 open node-forge Dependabot alerts (fixed in 1.4.1). Lockfile only: selfsigned already allows ^1.

node-forge reaches the example app through react-scripts → webpack-dev-server → selfsigned, which uses it to make the dev server's self-signed certificate. It does not ship in the library.

1.4.3 is the newest release, but it is under 7 days old, so min-release-age=7 excludes it.

Fixed Issues

$ https://github.com/Expensify/Expensify/issues/701679

AI Tests

• npm ls node-forge --all --package-lock-only in example/ resolves only 1.4.2.
• selfsigned@2.1.1 with node-forge@1.4.2 generated a 2048-bit certificate and key.

Tests

1. In example/, run npm ci.
2. Run npm run web.
3. Confirm the dev server starts and the example page loads.

QA

NA

– written by Claude on Amy's behalf

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[amyevans]

I have read the CLA Document and I hereby sign the CLA