Skip to content

Update node-forge, storybook and qs to fix vulnerabilities#6038

Merged
JamesBurnside merged 2 commits intomainfrom
angelcaz/update-package-vulnerabilities
Jan 12, 2026
Merged

Update node-forge, storybook and qs to fix vulnerabilities#6038
JamesBurnside merged 2 commits intomainfrom
angelcaz/update-package-vulnerabilities

Conversation

@angelcaz-msft
Copy link
Member

What

This PR updates the following dependencies to address security vulnerabilities:

  • Upgraded node-forge from 1.3.1 to ^1.3.3 across multiple packages and added a global override for transitive dependencies.
  • Upgraded storybook related packages from 8.6.12 to 8.6.15.
  • Added a globalOverrides for qs to force version ^6.14.1 globally.

Why

These updates target known security vulnerabilities in third-party dependencies:

  • node-forge: Addressed security issues by updating direct dependencies and forcing transitive usages through pnpm-config.json.
  • Storybook: Update required to patch vulnerabilities in the previous version (8.6.12).
  • qs: Transitive dependency vulnerability fixed by overriding the version to ^6.14.1 in pnpm-config.json.
  • image

How Tested

  • Ran rush update --full and rush update --full --variant stable to regenerate lockfiles and apply overrides.
  • Verified common/config/rush/pnpm-lock.yaml to ensure:
    • node-forge resolves to 1.3.3 (which covers 1.3.2+).
    • qs resolves to 6.14.0 (or the safe version defined).
    • storybook packages are at 8.6.15.
  • Validated that the build passes locally (rush build).
image

Process & policy checklist

  • I have updated the project documentation to reflect my changes if necessary.
  • I have read the CONTRIBUTING documentation.

Is this a breaking change?

  • This change causes current functionality to break.

@angelcaz-msft angelcaz-msft requested review from a team as code owners January 9, 2026 18:01
@angelcaz-msft angelcaz-msft added the does not need changelog Changes that does not affect the published package in any way do not need changelog entry label Jan 9, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

@azure/communication-react jest test coverage for stable.

Lines Statements Functions Branches
Base 29739 / 47381
62.76%
29739 / 47381
62.76%
810 / 1491
54.32%
2394 / 3842
62.31%
Current 29672 / 47411
62.58%
29672 / 47411
62.58%
814 / 1496
54.41%
2441 / 3867
63.12%
Diff -67 / 30
-0.18%
-67 / 30
-0.18%
4 / 5
0.09%
47 / 25
0.81%

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

@azure/communication-react jest test coverage for beta.

Lines Statements Functions Branches
Base 58580 / 95109
61.59%
58580 / 95109
61.59%
1180 / 2709
43.55%
3417 / 5799
58.92%
Current 58514 / 95177
61.47%
58514 / 95177
61.47%
1184 / 2714
43.62%
3429 / 5809
59.02%
Diff -66 / 68
-0.12%
-66 / 68
-0.12%
4 / 5
0.07%
12 / 10
0.1%

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

📦 Calling bundle size

Bundle Base Size (bytes) Current Size (bytes) Change Delta (bytes)
build.bundle.js 6767681 6768296 ⚠️ increased 615
580.bundle.js 12407925 12407925 ➖ unchanged 0

Total change: +615 B ⚠️

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

📦 CallWithChat bundle size

Bundle Base Size (bytes) Current Size (bytes) Change Delta (bytes)
build.bundle.js 7758336 7758978 ⚠️ increased 642
450.bundle.js 4470 4470 ➖ unchanged 0
580.bundle.js 12407938 12407938 ➖ unchanged 0
727.bundle.js 372564 372564 ➖ unchanged 0
82.bundle.js 28177 28155 ⬇️ decreased -22
91.bundle.js 4118 4118 ➖ unchanged 0

Total change: +620 B ⚠️

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

📦 Chat bundle size

Bundle Base Size (bytes) Current Size (bytes) Change Delta (bytes)
build.bundle.js 1793916 1793882 ⬇️ decreased -34
398.bundle.js 375829 375829 ➖ unchanged 0
450.bundle.js 4454 4454 ➖ unchanged 0
82.bundle.js 28161 28139 ⬇️ decreased -22
91.bundle.js 4102 4102 ➖ unchanged 0

Total change: -56 B ⬇️

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

@JamesBurnside JamesBurnside merged commit aa5eca6 into main Jan 12, 2026
45 checks passed
@JamesBurnside JamesBurnside deleted the angelcaz/update-package-vulnerabilities branch January 12, 2026 19:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

does not need changelog Changes that does not affect the published package in any way do not need changelog entry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Comments