[bhabalan]

COMPLETES #CVE-2026-85393

This pull request addresses

Widgets repository installs currently select node-forge@1.3.1 through the SDK's node-jose dependency and the development server's selfsigned dependency. This version predates the RSA signature-verification fixes for CVE-2026-85393.

by making the following changes

• Add "node-forge": "^1.4.3" to the root package.json resolutions.
• Regenerate yarn.lock to select Forge 1.4.3 and its checksum. The manifest sets the minimum version for future repository installs; the lockfile records the exact version used by the build.
• Record the Forge requirement in the legacy meetings widget spec.

The widget keeps webex external. Host applications must update their own lockfiles because root resolutions are not inherited by published package consumers.

Related PRs: SDK #5373 applies the same Forge requirement. Interfaces #181 removes the separate production dependency paths to timespan and inflight; that fix requires an interfaces package release.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• The testing is done with the amplify link

Using Node 22.14.0:

• yarn install --immutable: passed.
• yarn workspace @webex/widgets test:unit --runInBand: passed, 30 tests, with the repository Jest binary on PATH.
• yarn workspace @webex/widgets build:src: passed.
• yarn build:dev: passed for all repository packages.
• The normal pre-commit hook passed yarn run test:unit and yarn run test:styles. The style check reported 6 existing warnings and no errors.
• Checks through the widget's installed node-jose and Forge dependencies: PEM Buffer import, RSA signing and verification, JWE encryption/decryption, and rejection of malformed nested DigestInfo data passed.
• A temporary fixture using the repository Yarn 4.5.1 binary selected Forge 1.4.3 before and after an unrelated dependency was added to package.json.
• GitHub consumer builds passed for Webpack, Vite, Parcel, Rollup, and esbuild. The Amplify preview build passed.

Full repository CI is pending code-owner validation through the validated label. Manual testing on the Amplify preview and live KMS integration tests were not run.

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - Please Specify
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

AI assistance: OpenAI Codex generated the manifest change, dependency baseline documentation, and this description. Yarn generated the lockfile. Existing source copyright notices were preserved.

Checklist before merging

• I have not skipped any automated checks
• All existing and new tests passed
• I have updated the testing document
• I have tested the functionality with amplify link

The full-test and Amplify checklist items remain open until those checks are complete. The dependency baseline was updated; a separate testing document was not updated.

---

Make sure to have followed the contributing guidelines before submitting.

[aws-amplify-us-east-2]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-757.d1b38q61t1z947.amplifyapp.com

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T08:43:33.162603Z	1af5be8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🎉 Your changes are now available!
Released in: webex-widgets-v1.28.2-next.11
📖 View full changelog →

Packages Updated	Version
@webex/widgets	1.28.2-next.11
samples-meeting-app	0.0.0-next.1

Thank you for your contribution!
🤖 This is an automated message. For queries, please contact support.