Bump node-forge from 1.4.0 to 1.4.2 in /website (#5472)

Summary:
Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.4.0 to 1.4.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md">node-forge's changelog</a>.</em></p>
<blockquote>
<h2>1.4.2 - 2026-10-27</h2>
<h3>Fixed</h3>
<ul>
<li>[pem] Convert non-string input to a string in <code>pem.decode()</code> as before
1.4.1. The 1.4.1 PEM ReDoS fix (GHSA-7wch-p9px-956x) caused a <code>TypeError</code>
for <code>Buffer</code> input, which is used by <code>node-jose</code>.
(<a href="https://redirect.github.com/digitalbazaar/forge/issues/1165">https://github.com/meta/pyrefly/issues/1165</a>)</li>
</ul>
<h2>1.4.1 - 2026-10-27</h2>
<h3>Notes</h3>
<ul>
<li>This release involved coordinating many security reports from many groups,
people, and robots over too long period of time. Thank you for your reports
and patience.</li>
<li>Claude Code was used to help organize, track, untangle, merge, test,
validate, fix, and improve it all. Further verification of fixes would be
welcome.</li>
<li>Tracking credits was challenging for some issues due to multiple email and
GitHub reports, incomplete contact details, or combining of partial reports
and fixes. Please let us know if there are credits changes needed here or in
advisory data.</li>
</ul>
<h3>Security</h3>
<ul>
<li><strong>HIGH</strong>: Signature forgery in RSA-PKCS due to ASN.1 extra field in
DigestAlgorithm.
<ul>
<li>RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low
public exponent keys (e=3). The fix for CVE-2026-33894 only checked the
element count of the outer DigestInfo. Attackers can add &quot;garbage&quot; elements
inside the nested DigestAlgorithm SEQUENCE in order to construct a
signature that passes verification, enabling Bleichenbacher style forgery.</li>
<li>Reported by Geo (<a href="https://github.com/geo-chen"><code>@​geo-chen</code></a>).</li>
<li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2026-85393">CVE-2026-85393</a></li>
<li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-2g46-22mc-6gwp">GHSA-2g46-22mc-6gwp</a></li>
</ul>
</li>
<li><strong>HIGH</strong>: Signature forgery in RSA-PKCS due to non-canonical DigestInfo
encoding.
<ul>
<li>RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo
encodings, such as NULL parameters with content, non-minimal length
encodings, and non-canonical OIDs. These provide attackers space to
construct forged signatures for low public exponent keys (e=3), similar to
CVE-2026-33894 and CVE-2026-85393.</li>
<li>Reported by Oren Yomtov (<a href="https://github.com/orenyomtov"><code>@​orenyomtov</code></a>, Fireblocks), Bronson Yen (Calif.io,
in collaboration with Claude and Anthropic Research), Kamil Hałajda,
<a href="https://github.com/pzartech"><code>@​pzartech</code></a>, <a href="https://github.com/antonlissone"><code>@​antonlissone</code></a>, and <a href="https://github.com/Brechard"><code>@​Brechard</code></a>.</li>
<li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2026-119192">CVE-2026-119192</a></li>
<li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-6qrw-m8cv-hcxf">GHSA-6qrw-m8cv-hcxf</a></li>
</ul>
</li>
<li><strong>HIGH</strong>: ASN.1 resource exhaustion via BIT STRING decoding.
<ul>
<li>An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption
(CWE-400) vulnerability in node-forge versions 1.4.0 and below enables
remote, unauthenticated attackers to exhaust CPU and memory with small
crafted DER or PEM inputs (certificates, keys, and other structures parsed</li>
</ul>
</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/digitalbazaar/forge/commit/7928054627d93ab8c0216b756246e8ca8d62a93e"><code>7928054</code></a> Release 1.4.2.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/1d8c2459ad95d7ae7535702d1e55c173773e7b11"><code>1d8c245</code></a> Update changelog.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/ce5b5760df260b7c7dfb3e047bc88f5e768fd31f"><code>ce5b576</code></a> Convert non-string input in <code>pem.decode()</code>.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/c1d64ef32b78dabf204158760efbd1fb552ec9cb"><code>c1d64ef</code></a> Fix changelog typo.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/453d196f29c51a5a976c9b743c4abb671e499d9c"><code>453d196</code></a> Start 1.4.2-0.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/8a917370ec51731e817c2d547b7329a58f8210af"><code>8a91737</code></a> Release 1.4.1.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/fdd1b9fd4c4e4974e86cd3c7e2f4f6310ba2d412"><code>fdd1b9f</code></a> Update changelog.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/4c1c3e3d2b6bcdc2e72446e07e1d6eeccc8de14a"><code>4c1c3e3</code></a> Add changelog release notes.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/0b455eb7c37a4df7c9b2e53d5057718c28d226de"><code>0b455eb</code></a> Ignore TLS heartbeat requests before the handshake.</li>
<li><a href="https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72"><code>e96c47b</code></a> Fix jsbn <code>modInverse</code> hang with negative inputs.</li>
<li>Additional commits viewable in <a href="https://github.com/digitalbazaar/forge/compare/v1.4.0...v1.4.2">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node-forge&package-manager=npm_and_yarn&previous-version=1.4.0&new-version=1.4.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

 ---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `dependabot rebase` will rebase this PR
- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/meta/pyrefly/network/alerts).

</details>

Pull Request resolved: #5472

Reviewed By: stroxler

Differential Revision: D128839014

fbshipit-source-id: c455a9d204d3dc16650cc28780a01675fc8bb20c

Author: dependabot[bot]

website/yarn.lock

@@ -10712,9 +10712,9 @@ node-fetch@^2.7.0:
     whatwg-url "^5.0.0"
 
 node-forge@^1:
-  version "1.4.0"
-  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-1.4.0.tgz#1c7b7d8bdc2d078739f58287d589d903a11b2fc2"
-  integrity sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==
+  version "1.4.2"
+  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-1.4.2.tgz#9988b154241e3b401a969a76cfb7aca7ddb5e70b"
+  integrity sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==
 
 node-int64@^0.4.0:
   version "0.4.0"