[hoangsvit]

Summary

This PR keeps the repository's dev → main release flow while handling Dependabot security updates safely.

Changes

• Sync the latest source-map-js security fix from main back into dev
  • source-map-js 1.2.1 → 1.2.2
  • fixes CVE-2026-93749 (DoS via malicious indexed source maps)
• Restrict grouped Dependabot version updates to minor/patch releases
• Prevent future major toolchain migrations (TypeScript/WXT/Vitest/jsdom, etc.) from being bundled into one large PR like chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #239
• Document in .github/dependabot.yml that Dependabot security updates always target the default branch (main)

Why

PR #239 grouped several major toolchain upgrades together and currently fails TypeScript compilation. Security remediation should not require accepting unrelated breaking toolchain migrations.

Flow

• Routine minor/patch version updates → dev
• Security updates → GitHub/default branch main
• Security fixes merged to main are synchronized back to dev

Validation

CI should confirm the configuration and the lockfile-only security update without introducing TypeScript/WXT/Vitest major changes.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 41909eb8-32e9-4082-91bc-755997726a6a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review or merge it after the required checks pass.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 00e9582...2a9d492 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 6, 2026 2:31a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/google-cloud-skills-boost-helper/actions/runs/37404206550

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI updated: 2026-10-06T02:28:03Z
CI attempt: #1
Approval workflow: #568.1

CI run: https://github.com/ePlus-DEV/google-cloud-skills-boost-helper/actions/runs/37404206550

[github-actions]

Thanks for helping make Google Cloud Skills Boost - Helper better!