From 94131b74ef098c1b3141c4666969d6be60112c8a Mon Sep 17 00:00:00 2001 From: aaronjmars Date: Mon, 24 Aug 2026 14:48:46 -0400 Subject: [PATCH] build(deps): drop the adm-zip overrides pin - upstream ranges now reach 0.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both upstream gates from #58 have cleared since it was filed: firefox-profile@4.7.1 → adm-zip ~0.6.x (was ~0.5.x) web-ext@10.6.0 → firefox-profile 4.7.1 (was exact 4.7.0) adm-zip latest is 0.6.0, so firefox-profile's own ~0.6.x range now resolves the patched 0.6.0 without the forced override. Removing the adm-zip entry leaves resolution byte-identical: `npm install --package-lock-only` produces no lockfile change and the tree still resolves adm-zip@0.6.0. The brace-expansion / shell-quote overrides are unrelated and stay. Verified locally: npm ci (exit 0), npm run build, node build.js validate (chrome+firefox pass), node test-extension.js, npx web-ext lint (0 errors). GHSA-xcpc-8h2w-3j85 no longer appears in npm audit. Closes #58. --- opendia-extension/package.json | 1 - 1 file changed, 1 deletion(-) diff --git a/opendia-extension/package.json b/opendia-extension/package.json index 8b03236..d914a6f 100644 --- a/opendia-extension/package.json +++ b/opendia-extension/package.json @@ -26,7 +26,6 @@ "web-ext": "^10.6.0" }, "overrides": { - "adm-zip": "^0.6.0", "brace-expansion": "^1.1.16", "shell-quote": "^1.9.0" }