[dependabot]

Bumps node-forge from 1.4.2 to 1.4.3.

Changelog

Sourced from node-forge's changelog.

1.4.3 - 2026-11-03

Security

• HIGH: X.509 certificate chain verification ignores name constraints.
  • pki.verifyCertificateChain() does not check the nameConstraints extension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension in a CA certificate is ignored, so a name-constrained intermediate CA can issue certificates for names outside its permitted subtrees, or inside its excluded subtrees, and the chain verifies. Exploitation requires the private key of a name-constrained CA that chains to a trusted root. A critical nameConstraints extension is rejected as an unsupported critical extension.
  • Reported by @​bhaswanthc.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-3cc4-3294-vgjf
• MODERATE: TLS client crash on a handshake record without a session.
  • A TLS client throws an uncaught TypeError from process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions. Servers are not affected.
  • Reported by @​manus-use.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-j8rw-jp99-435v
• MODERATE: ReDoS in forge.http response header parsing.
  • forge.http trims response header and Set-Cookie values with a regular expression that takes quadratic time on a long run of whitespace followed by another character. A server, or an on-path attacker, can block a forge.http client for minutes with one large header.
  • Reported by @​manus-pi.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-6cv4-p8m7-4r25
• MODERATE: TLS client crash on an unsupported ServerHello compression method.
  • A TLS client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes process() throw an uncaught Error at ServerHelloDone, before the server is authenticated. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions, including through forge.tls.wrapSocket. Servers are not affected.
  • Reported by @​alienkeric.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-w4xr-hqv8-ch44
• LOW: Ed25519 signature verification accepts small-order public keys.
  • ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many or, with the identity key, all messages, without any private key. Applications are affected only if

... (truncated)

Commits

• 936b24d Release 1.4.3.
• 4d8f79a Update changelog.
• 1d9816d Check the ServerHello compression method.
• 326a4d0 Trim forge.http header values in linear time.
• 2cfaeb5 Ignore handshake messages on a TLS client without a session.
• 6b23eae Complete nameConstraints enforcement.
• 862aa5f Enforce nameConstraints in verifyCertificateChain().
• 956f2b5 Document ed25519.verify() small-order key behavior.
• 1b77e6f Reject small-order Ed25519 public keys in verify.
• 2bd5146 Add GitHub usernames to credits.
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pipedream-docs-redirect-do-not-edit	Ignored		Nov 13, 2026 11:25pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: PipedreamHQ/pipedream
• Branch: master
• File: .coderabbit.yaml
• Commit: de447d7
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3a227260-ac98-4975-a37d-95f894c96f60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[pipedream-component-development]

Thank you so much for submitting this! We've added it to our backlog to review, and our team has been notified.

[pipedream-component-development]

Thanks for submitting this PR! When we review PRs, we follow the Pipedream component guidelines. If you're not familiar, here's a quick checklist:

• Create components to address specific use cases whenever possible
• Component keys should follow the format app_name_slug-slugified-component-name
• Components should follow the standard directory structure
• Prefer Node.js client libraries to REST APIs
• When making API requests, handle pagination to ensure all data / events are processed
• Use secret props to capture sensitive data
• Props and methods should be defined in app files whenever possible
• Document methods with JS Docs
• Use optional props whenever possible, and set a default value where you can
• Use standalone actions over async options and ensure the description of the prop indicates usage of the standalone action to fetch the data for the prop
• Please address all review comments as they are added
• Enable edits from maintainers to allow Pipedream maintainers to make changes to this PR