build(deps): drop the adm-zip overrides pin (upstream ranges reach 0.6.0) - #72
Merged
Conversation
…ch 0.6.0 Both upstream gates from #58 have cleared since it was filed: firefox-profile@4.7.1 → adm-zip ~0.6.x (was ~0.5.x) web-ext@10.6.0 → firefox-profile 4.7.1 (was exact 4.7.0) adm-zip latest is 0.6.0, so firefox-profile's own ~0.6.x range now resolves the patched 0.6.0 without the forced override. Removing the adm-zip entry leaves resolution byte-identical: `npm install --package-lock-only` produces no lockfile change and the tree still resolves adm-zip@0.6.0. The brace-expansion / shell-quote overrides are unrelated and stay. Verified locally: npm ci (exit 0), npm run build, node build.js validate (chrome+firefox pass), node test-extension.js, npx web-ext lint (0 errors). GHSA-xcpc-8h2w-3j85 no longer appears in npm audit. Closes #58.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes the
adm-zipoverridespin inopendia-extension/package.json, added by #56 as a stopgap for GHSA-xcpc-8h2w-3j85. Tracked in #58.Why now — both upstream gates cleared
4.7.0→~0.5.x(unreachable)4.7.1→~0.6.x10.5.0→ exact4.7.010.6.0→4.7.1adm-ziplatest is0.6.0, so firefox-profile's own~0.6.xnow resolves the patched version natively — the override is redundant.Safety
Resolution is byte-identical with vs without the override:
npm install --package-lock-onlyproduces no lockfile change, and the tree still resolvesadm-zip@0.6.0. The unrelatedbrace-expansion/shell-quoteoverrides are untouched.Verified locally (extension CI steps, from #58's checklist)
npm ci→ exit 0 (lock satisfies package.json)npm run build→ chrome + firefox builtnode build.js validate→ both builds passnode test-extension.js→ passnpx web-ext lint --source-dir=dist/firefox --self-hosted→ 0 errors (3 pre-existing warnings)npm audit→ GHSA-xcpc-8h2w-3j85 no longer presentCloses #58.