node-forge Prototype Pollution vulnerability

[flo-sch]

This package has a dependency towards [email protected] which has an upstream vulnerability towards node-forge: https://www.npmjs.com/advisories/1561

The vulnerability has been fixed upstream by [email protected] (latest release being [email protected])

Would it be possible to release a new version of this package bumping that dependency, to fix this vulnerability issue?

I have no experience with that dependency myself, but it is not a major release so I am expecting such a bump to be straightforward...?

[kevalone]

Any update on this. Any issues in merging suggested PR - https://github.com/notifme/notifme-sdk/pull/84?

[flo-sch]

I am not quite certain this package is still actively maintained to be honest. That would be sad since I do not know a lot of alternatives, but this is the Open Source life 🤷‍♂