chore(release): promote dev to main for v1.3.4 by hoangsvit · Pull Request #260 · ePlus-DEV/google-cloud-skills-boost-helper

hoangsvit · 2026-10-30T09:00:22Z

Release 1.3.4 — dev → main

This PR proposes the tested dev state for the next Google Cloud Skills Boost Helper extension release. Review / merge only; this PR does not create a tag or publish browser packages.

Included

fix(release): v1.3.5 prevent duplicate +10 Arcade Bonus Milestone #258: Fix double-counting of self-reported +10 Bonus Milestone, preserve original Arcade API totals, improve popup/avatar consistency, and add score regression tests.
security: audit locked dependencies before v1.3.5 release #259: Patch vulnerable direct and transitive dependencies; update package.json and yarn.lock; introduce frozen-lockfile dependency auditing. The recorded Yarn audit dropped from 49 vulnerability findings to 1.
Keep extension version at 1.3.4 (already bumped on main, but not tagged/released). Consolidate the unreleased 1.3.4 changelog entries.

Release gate / security disclosure

Revalidate type checks, tests, builds, and dependency audit on this PR's latest commit.
Resolve merge conflicts between dev and main (preserve WXT 0.21.5, Firebase 13.1.0 and Arcade fixes).
Confirm real extension popup and avatar agree on 130 after +10 confirmation, refresh, reopen, and switching accounts.
Confirm Chrome and Firefox release packages.
Review the dependency audit after merging WXT 0.21.5 into dev. The old node-forge / web-ext-run dependency path is absent from the resolved yarn.lock; confirm the final security result before publishing.
Confirm release notes and publishing credentials.

Tag / store publishing

The .github/workflows/release.yml workflow responds to a numeric semver tag such as 1.3.4 and subsequently builds, creates GitHub Release and submits extension packages to Chrome/Firefox stores. Do not push the 1.3.4 tag until this PR has been reviewed and merged, plus release/security gates resolved. Create that tag on the approved main commit only.

Version rationale: The latest published GitHub Release and tag is 1.3.3; main already had an unreleased 1.3.4 manifest. This PR prepares the next release as 1.3.4 without skipping a release version.

Earlier main/dev conflicts were resolved in merge commit 633b124. Do not merge until required checks and browser tests pass.

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…actions/setup-node-7.1.0 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0

Bumps the production-dependencies group with 2 updates: [@wxt-dev/storage](https://github.com/wxt-dev/wxt/tree/HEAD/packages/storage) and [marked](https://github.com/markedjs/marked). Updates `@wxt-dev/storage` from 1.2.9 to 1.3.0 - [Release notes](https://github.com/wxt-dev/wxt/releases) - [Changelog](https://github.com/wxt-dev/wxt/blob/main/packages/storage/CHANGELOG.md) - [Commits](https://github.com/wxt-dev/wxt/commits/storage-v1.3.0/packages/storage) Updates `marked` from 18.0.14 to 18.1.0 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.0.14...v18.1.0) --- updated-dependencies: - dependency-name: "@wxt-dev/storage" dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: marked dependency-version: 18.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [firebase](https://github.com/firebase/firebase-js-sdk) from 12.19.0 to 13.0.0. - [Release notes](https://github.com/firebase/firebase-js-sdk/releases) - [Changelog](https://github.com/firebase/firebase-js-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/firebase/firebase-js-sdk/compare/firebase@12.19.0...firebase@13.0.0) --- updated-dependencies: - dependency-name: firebase dependency-version: 13.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…oduction-dependencies-fd93774ae1 chore(deps): bump the production-dependencies group with 2 updates

…rebase-13.0.0 chore(deps): bump firebase from 12.19.0 to 13.0.0

Bumps the production-dependencies group with 4 updates: [dompurify](https://github.com/cure53/DOMPurify), [marked](https://github.com/markedjs/marked), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom). Updates `dompurify` from 3.4.16 to 3.4.17 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.16...3.4.17) Updates `marked` from 18.1.0 to 18.1.1 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.1.0...v18.1.1) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: marked dependency-version: 18.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

…oduction-dependencies-14fa9fbd36 chore(deps): bump the production-dependencies group with 4 updates

Bumps the production-dependencies group with 1 update: [firebase](https://github.com/firebase/firebase-js-sdk). Updates `firebase` from 13.0.0 to 13.1.0 - [Release notes](https://github.com/firebase/firebase-js-sdk/releases) - [Changelog](https://github.com/firebase/firebase-js-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/firebase/firebase-js-sdk/compare/firebase@13.0.0...firebase@13.1.0) --- updated-dependencies: - dependency-name: firebase dependency-version: 13.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

…oduction-dependencies-b63b6b459e chore(deps): bump firebase from 13.0.0 to 13.1.0 in the production-dependencies group

This commit fixes the style issues introduced in 424a5a8 according to the output from Prettier. Details: #258

This commit fixes the style issues introduced in 7e9d041 according to the output from Prettier. Details: #258

This commit fixes the style issues introduced in ceacc13 according to the output from Prettier. Details: #258

This commit fixes the style issues introduced in cce8b0a according to the output from Prettier. Details: #258

…ry async

This commit fixes the style issues introduced in 941fd16 according to the output from Prettier. Details: #258

…validated patch

…1030 security: audit locked dependencies before v1.3.5 release

eplus-bot · 2026-10-30T09:00:30Z

Thank you for creating this pull request and helping make the project better.

We will review or merge it after the required checks pass.

qodo-code-review · 2026-10-30T09:00:30Z

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

coderabbitai · 2026-10-30T09:00:31Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 77ada761-e0d6-4574-87f0-985fa700d4b3

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-10-30T09:01:27Z

DeepSource Code Review

We reviewed changes in a5eed96...cec4129 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 30, 2026 9:42a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

… task execution

Keep WXT 0.21.5 and main-only TypeScript config/test updates; retain dev extension v1.3.5, Firebase 13, Arcade 130-point regression fixes and patched dependencies. Reconcile Yarn 1 lock selectors against the merged manifest.

Latest GitHub release is v1.3.3. Keep next version at 1.3.4 and consolidate release notes, preserving Arcade score fixes, dependency security patches, and WXT upgrade.

github-actions · 2026-10-30T09:46:55Z

Thanks for helping make Google Cloud Skills Boost - Helper better!

dependabot Bot and others added 30 commits October 12, 2026 16:46

Merge pull request #247 from ePlus-DEV/dependabot/github_actions/dev/…

3d9ed14

…actions/setup-node-7.1.0 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0

Merge pull request #248 from ePlus-DEV/dependabot/npm_and_yarn/dev/pr…

f93ee78

…oduction-dependencies-fd93774ae1 chore(deps): bump the production-dependencies group with 2 updates

Merge pull request #249 from ePlus-DEV/dependabot/npm_and_yarn/dev/fi…

bf6124a

…rebase-13.0.0 chore(deps): bump firebase from 12.19.0 to 13.0.0

Merge pull request #250 from ePlus-DEV/dependabot/npm_and_yarn/dev/pr…

a574fcc

…oduction-dependencies-14fa9fbd36 chore(deps): bump the production-dependencies group with 4 updates

Merge pull request #253 from ePlus-DEV/dependabot/npm_and_yarn/dev/pr…

8d27072

…oduction-dependencies-b63b6b459e chore(deps): bump firebase from 13.0.0 to 13.1.0 in the production-dependencies group

fix: prevent Arcade bonus score double counting

a8a4d57

fix: prevent Arcade bonus score double counting

67e6a40

fix: prevent Arcade bonus score double counting

c5a007a

fix: prevent Arcade bonus score double counting

73752e5

fix: prevent Arcade bonus score double counting

818cd68

fix: prevent Arcade bonus score double counting

4d7f770

fix: prevent Arcade bonus score double counting

424a5a8

style: format code with Prettier

0fbff7c

This commit fixes the style issues introduced in 424a5a8 according to the output from Prettier. Details: #258

fix: repair backtick delimiters in bonus score regression test

7e9d041

style: format code with Prettier

cb913b1

This commit fixes the style issues introduced in 7e9d041 according to the output from Prettier. Details: #258

refactor: address DeepSource countdown complexity and empty catches

2893b35

fix: close refactored countdown service method correctly

ceacc13

test: cover Remote Config countdown lifecycle and single Arcade fallback

b4d3aa9

style: format code with Prettier

ab61573

This commit fixes the style issues introduced in ceacc13 according to the output from Prettier. Details: #258

test: mock WXT browser i18n for countdown completion scenarios

cce8b0a

style: format code with Prettier

b682646

This commit fixes the style issues introduced in cce8b0a according to the output from Prettier. Details: #258

style: replace countdown string concatenation with template literals

6d37632

test: return explicit Promises from countdown mocks without unnecessa…

941fd16

…ry async

style: format code with Prettier

d9cc478

This commit fixes the style issues introduced in 941fd16 according to the output from Prettier. Details: #258

fix: remove redundant undefined argument from countdown test mock

414b4bb

hoangsvit and others added 5 commits October 30, 2026 15:51

ci(security): run constrained lockfile patch and validate before commit

f1534d8

ci(security): force a single patched Vite version in Yarn 1 graph

1218d17

fix(security): patch known vulnerable dependencies

1016b2c

chore(security): remove one-time privileged dependency updater after …

2b5b9ce

…validated patch

Merge pull request #259 from ePlus-DEV/security/dependency-audit-2026…

e6003b8

…1030 security: audit locked dependencies before v1.3.5 release

eplus-bot added the needs-review Pull request is ready for maintainer review label Oct 30, 2026

github-actions Bot assigned hoangsvit Oct 30, 2026

eplus-bot added the app Application or extension source code label Oct 30, 2026

github-actions Bot added area: config area: docs area: release area: services area: tests area: ui labels Oct 30, 2026

eplus-bot added tests Test coverage or test tooling changes build-ci Build, CI, release, or project configuration documentation Improvements or additions to documentation labels Oct 30, 2026

eplus-bot self-requested a review October 30, 2026 09:00

This was referenced Oct 30, 2026

fix(security): backport patched dependencies to main without version bump #262

Merged

fix(security): eliminate node-forge via WXT 0.21 without version bump #263

Merged

hoangsvit added 3 commits October 30, 2026 16:32

chore(docs): update contributing guidelines for Windows NVM usage and…

2c7496e

… task execution

merge(main): resolve conflicts for v1.3.5 release

633b124

Keep WXT 0.21.5 and main-only TypeScript config/test updates; retain dev extension v1.3.5, Firebase 13, Arcade 130-point regression fixes and patched dependencies. Reconcile Yarn 1 lock selectors against the merged manifest.

chore(release): align next release with v1.3.4 tag sequence

cec4129

Latest GitHub release is v1.3.3. Keep next version at 1.3.4 and consolidate release notes, preserving Arcade score fixes, dependency security patches, and WXT upgrade.

hoangsvit changed the title ~~chore(release): promote dev to main for v1.3.5~~ chore(release): promote dev to main for v1.3.4 Oct 30, 2026

hoangsvit merged commit 81b2c13 into main Oct 30, 2026
12 checks passed

Navigation Menu

Repository navigation

chore(release): promote dev to main for v1.3.4 - #260

chore(release): promote dev to main for v1.3.4#260
hoangsvit merged 43 commits into
mainfrom
dev

hoangsvit commented Oct 30, 2026 •

edited

Loading

Uh oh!

eplus-bot commented Oct 30, 2026

Uh oh!

qodo-code-review Bot commented Oct 30, 2026

Uh oh!

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hoangsvit commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 1.3.4 — dev → main

Included

Release gate / security disclosure

Tag / store publishing

Uh oh!

eplus-bot commented Oct 30, 2026

Uh oh!

qodo-code-review Bot commented Oct 30, 2026

Uh oh!

coderabbitai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepsource-io Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hoangsvit commented Oct 30, 2026 •

edited

Loading

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

deepsource-io Bot commented Oct 30, 2026 •

edited

Loading