chore: update selfsigned dependency for a security patch

[darthsoup]

• This is a dependency update
• This is a bugfix
• This is a feature
• This is a code refactor
• This is a test update
• This is a docs update
• This is a metadata update

For Bugs and Features; did you add new tests?

Motivation / Use-Case

Security vulnerability in the selfsigned dependency caused by node-forge

Breaking Changes

Additional Info

[jsf-clabot]

All committers have signed the CLA.

[codecov]

Codecov Report

Merging #2752 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #2752   +/-   ##
=======================================
  Coverage   93.77%   93.77%           
=======================================
  Files          34       34           
  Lines        1333     1333           
  Branches      381      381           
=======================================
  Hits         1250     1250           
  Misses         81       81           
  Partials        2        2           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4ab1f21...955e2f1. Read the comment docs.

[afdev82]

any news on this? Thank you :)

[darthsoup]

any news on this? Thank you :)

nope.... local testing works fine, unittests only crashes on azure testing instances

PS: sorry for the duplicated MR. I did not notice at first sight

[reginandrade]

is there an anticipated timeframe for fixing failing checks and getting this merged? thank you.

[smridge]

CVE function in question does not appear to be directly used in this repo or forge
https://github.com/digitalbazaar/forge/blob/588c41062d9a13f8dc91be3723b159c6cc434b15/CHANGELOG.md#L11-L42 .

@hiroppy / @evilebottnawi / @Loonride thoughts on using yarn resolutions or the npm equivalent until this is merged?

[smridge]

Apologies, I just realized this is a duplicate PR of #2740 & #2795 . Seems like using our own override in the interim would be the best solution until the CI gets fixed.

[alexander-akait]

Duplicate #2740