Hi,

I am proposing to resolve CVEs GHSA-554w-wpv2-vw27 and GHSA-5gfm-wpxj-wjgq which relate to node-forge, a transitive dependency of listhen.
I could resolve the node-forge vulnerabilities by using an override of that dependency as there is no newer version of listhen. But I have two questions:
1 - Do vulnerabilities relating to a transitive dependency of listhen need to be updated? listhen is only used for testing.
2 - Would an override of node-forge be acceptable as a resolution approach if update is necessary?

"pnpm": {
    "overrides": {
         "node-forge": "^1.3.2"
    }
}

Thanks!