@hilbras/omnihilbras 2.9.6 → 2.9.7

package/app/node_modules/node-forge/package.json

@@ -0,0 +1,123 @@
+{
+  "name": "node-forge",
+  "version": "1.4.0",
+  "description": "JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.",
+  "homepage": "https://github.com/digitalbazaar/forge",
+  "author": {
+    "name": "Digital Bazaar, Inc.",
+    "email": "support@digitalbazaar.com",
+    "url": "http://digitalbazaar.com/"
+  },
+  "contributors": [
+    "Dave Longley <dlongley@digitalbazaar.com>",
+    "David I. Lehn <dlehn@digitalbazaar.com>",
+    "Stefan Siegl <stesie@brokenpipe.de>",
+    "Christoph Dorn <christoph@christophdorn.com>"
+  ],
+  "devDependencies": {
+    "browserify": "^16.5.2",
+    "commander": "^2.20.0",
+    "cross-env": "^5.2.1",
+    "eslint": "^7.27.0",
+    "eslint-config-digitalbazaar": "^2.8.0",
+    "express": "^4.16.2",
+    "karma": "^4.4.1",
+    "karma-browserify": "^7.0.0",
+    "karma-chrome-launcher": "^3.1.0",
+    "karma-edge-launcher": "^0.4.2",
+    "karma-firefox-launcher": "^1.3.0",
+    "karma-ie-launcher": "^1.0.0",
+    "karma-mocha": "^1.3.0",
+    "karma-mocha-reporter": "^2.2.5",
+    "karma-safari-launcher": "^1.0.0",
+    "karma-sauce-launcher": "^2.0.2",
+    "karma-sourcemap-loader": "^0.3.8",
+    "karma-tap-reporter": "0.0.6",
+    "karma-webpack": "^4.0.2",
+    "mocha": "^5.2.0",
+    "mocha-lcov-reporter": "^1.2.0",
+    "nodejs-websocket": "^1.7.1",
+    "nyc": "^15.1.0",
+    "opts": "^1.2.7",
+    "webpack": "^4.44.1",
+    "webpack-cli": "^3.3.12",
+    "worker-loader": "^2.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/digitalbazaar/forge"
+  },
+  "bugs": {
+    "url": "https://github.com/digitalbazaar/forge/issues",
+    "email": "support@digitalbazaar.com"
+  },
+  "license": "(BSD-3-Clause OR GPL-2.0)",
+  "main": "lib/index.js",
+  "files": [
+    "lib/*.js",
+    "flash/swf/*.swf",
+    "dist/*.min.js",
+    "dist/*.min.js.map"
+  ],
+  "engines": {
+    "node": ">= 6.13.0"
+  },
+  "keywords": [
+    "aes",
+    "asn",
+    "asn.1",
+    "cbc",
+    "crypto",
+    "cryptography",
+    "csr",
+    "des",
+    "gcm",
+    "hmac",
+    "http",
+    "https",
+    "md5",
+    "network",
+    "pkcs",
+    "pki",
+    "prng",
+    "rc2",
+    "rsa",
+    "sha1",
+    "sha256",
+    "sha384",
+    "sha512",
+    "ssh",
+    "tls",
+    "x.509",
+    "x509"
+  ],
+  "scripts": {
+    "prepublish": "npm run build",
+    "build": "webpack",
+    "test-build": "webpack --config webpack-tests.config.js",
+    "test": "npm run test-node",
+    "test-node": "cross-env NODE_ENV=test mocha -t 30000 -R ${REPORTER:-spec} tests/unit/index.js",
+    "test-karma": "karma start",
+    "test-karma-sauce": "karma start karma-sauce.conf",
+    "test-server": "node tests/server.js",
+    "test-server-ws": "node tests/websockets/server-ws.js",
+    "test-server-webid": "node tests/websockets/server-webid.js",
+    "coverage": "rm -rf coverage && nyc --reporter=lcov --reporter=text-summary npm test",
+    "coverage-ci": "rm -rf coverage && nyc --reporter=lcovonly npm test",
+    "coverage-report": "nyc report",
+    "lint": "eslint *.js lib/*.js tests/*.js tests/**/*.js examples/*.js flash/*.js"
+  },
+  "nyc": {
+    "exclude": [
+      "tests"
+    ]
+  },
+  "jspm": {
+    "format": "amd"
+  },
+  "browser": {
+    "buffer": false,
+    "crypto": false,
+    "process": false
+  }
+}

package/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnihilbras-app",
-  "version": "2.9.6",
+  "version": "2.9.7",
   "description": "OmniHilbras web dashboard",
   "private": true,
   "scripts": {

package/hooks/postinstall.js

@@ -23,4 +23,26 @@ try {
   console.warn(`[omnihilbras] tray runtime skipped: ${e.message}`);
 }
 
+// Apply the node-forge security patch (CVE-2026-85393) to the copy that ships
+// with this package. The patch script is bundled at <pkg>/app/scripts/; the
+// runtime-resolved node-forge is at <pkg>/app/node_modules/node-forge (the
+// standalone server loads it from there). Both are resolved from __dirname
+// (which is <pkg>/hooks/ at install time). Failure is non-fatal: the app
+// still starts, only the MITM cert-generation path stays unpatched.
+const forgePatchSrc = require("path").join(__dirname, "..", "app", "scripts", "apply-node-forge-patch.cjs");
+if (require("fs").existsSync(forgePatchSrc)) {
+  try {
+    // Point the script at <pkg>/app/node_modules/node-forge — the copy the
+    // standalone server actually loads. The script's own default
+    // (../node_modules from app/scripts/) resolves to the same path, so this
+    // env override is belt-and-braces for non-standard layouts.
+    process.env.NODE_FORGE_ASN1_JS = require("path").join(
+      __dirname, "..", "app", "node_modules", "node-forge", "lib", "asn1.js"
+    );
+    require(forgePatchSrc);
+  } catch (e) {
+    console.warn(`[omnihilbras] node-forge patch skipped: ${e.message}`);
+  }
+}
+
 process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hilbras/omnihilbras",
-  "version": "2.9.6",
+  "version": "2.9.7",
   "description": "OmniHilbras CLI - Start and manage OmniHilbras server",
   "bin": {
     "omnihilbras": "./cli.js"
@@ -27,7 +27,8 @@
     "node-machine-id": "^1.1.12",
     "react": "19.2.1",
     "react-dom": "19.2.1",
-    "confbox": "^0.2.4"
+    "confbox": "^0.2.4",
+    "node-forge": "^1.4.0"
   },
   "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.omnihilbras/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",
   "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.omnihilbras/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails to load on modern macOS dyld. Neither package ships an arm64 macOS binary, so on Apple Silicon hooks/trayRuntime.js overlays our own arm64 build from the tray-binaries GitHub release; without it the tray requires Rosetta 2.",