npm audit security vulnerability in node-forge

Npm audit indicates a vulnerability in the node-forge dependency.

 === npm audit security report ===                        
│ High          │ Prototype Pollution in node-forge                            │
│ Package       │ node-forge                                                   │
│ Patched in    │ >= 0.10.0                                                    │
│ Dependency of │ actions-on-google                                            │
│ Path          │ actions-on-google > googleapis > googleapis-common >         │
│               │ google-auth-library > gtoken > google-p12-pem > node-forge   │
│ More info     │ https://npmjs.com/advisories/1561    

[proppy]

@digitaltoast https://github.com/actions-on-google/assistant-conversation-nodejs is used for conversation action using Action Builder with the new Action SDK, while this repository is still relevant for Smart Home actions.

Looks like the vulnerability in this repository would require a major version upgrade for the google-auth-library:

-    "google-auth-library": "^1.6.1",
+    "google-auth-library": "^7.0.4",

while would in turn transitively change the node engine requirements from:

  "engines": {
    "node": ">=6.13.0"
  },

to:

  "engines": {
    "node": ">=10"
  },

This seems like a reasonable change to me since both Node.js 6 and 8 are not actively supported anymore by the Node.js project: https://nodejs.org/en/about/releases/, but would require a major version bump of the library itself.

[tommybluhm]

Is there any update on this? Please fix the security issues!