[hoangsvit]

Security hotfix only — main (no release/version changes)

This PR was branched from main, deliberately independent of v1.3.5 release PR #260.

What is included

• Patch vulnerable pinned dependencies including vite, vitest, @vitest/mocker, undici, shell-quote, esbuild, nanoid, zod, re2js, adm-zip, @grpc/grpc-js, and follow-redirects.
• Update only package.json and yarn.lock.
• Keep package.json at 1.3.4; do not include Bonus Milestone patch, CHANGELOG.md, release tags, or publishing.

Validation

• Yarn resolved the patched lockfile.
• TypeScript compilation.
• Unit tests with coverage.
• Chrome build.
• Firefox build.
• Post-patch yarn audit: 0 critical, 0 moderate, 0 low, and 1 high.
• Final PR-required CI/status checks.

Known remaining risk

One high advisory remains: node-forge@1.4.0, GHSA-86w9-cpqp-85rv, pulled by the WXT web-ext-run → adbkit developer-tool dependency. At the time of audit, no patched version was available; removal requires a separate WXT migration. This hotfix does not claim zero alerts.

The temporary write-enabled patch workflow has been removed from the final diff. Do not create a release tag as part of this PR.

Release sequencing

Merge security-only fixes to main first. Subsequently resolve conflicts and independently review/release PR #260 (dev → main, version 1.3.5).

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1cc037ac-f8b9-4a60-9c8e-0a1509edf4f3

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review or merge it after the required checks pass.

[deepsource-io]

DeepSource Code Review

We reviewed changes in a70707e...4cff2dc on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 30, 2026 9:08a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/google-cloud-skills-boost-helper/actions/runs/41031139568

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI updated: 2026-10-30T09:08:43Z
CI attempt: #1
Approval workflow: #623.1

CI run: https://github.com/ePlus-DEV/google-cloud-skills-boost-helper/actions/runs/41031139568

[github-actions]

Thanks for helping make Google Cloud Skills Boost - Helper better!