[hoangsvit]

Security fix: remove vulnerable node-forge from main

Targets main only; no release/version bump.

Confirmed cause and mitigation

• Existing WXT 0.20 includes web-ext-run → @devicefarmer/adbkit → node-forge@1.4.0, affected by GHSA-86w9-cpqp-85rv.
• Upgrade WXT to ^0.21.5, where the browser runner/web-ext is optional rather than automatically installed. Do not install optional web-ext; dev mode will no longer auto-open a browser until opted in separately.
• Regenerate yarn.lock and verify neither node-forge nor web-ext-run is present.
• Keep package.json version at 1.3.4. No Bonus Milestone logic or release workflow changes.
• Keep WXT 0.20-compatible TypeScript behavior by explicitly setting verbatimModuleSyntax: false and noUncheckedIndexedAccess: false in project tsconfig.json; migration to the stricter compiler options can follow independently.
• Adapt two runtime-message test fixtures for WXT 0.21 fake-browser typing (no app behavior changed).

Validated on the proposed dependency graph

• yarn install --force --ignore-scripts --ignore-engines
• yarn wxt prepare
• yarn compile
• yarn test:coverage — 31 test files passed
• yarn build and yarn build:firefox
• yarn zip and yarn zip:firefox
• yarn audit --json: 0 critical / high / moderate / low advisories
• Temporary write-capable validation workflow removed after generated lockfile was committed
• Final branch CI / React Doctor / DeepSource checks
• Manual developer-mode smoke test (browser no longer launches automatically)

Release sequencing

Merge the security PR into main first. The separate dev → main PR #260 for release 1.3.5 remains unmerged and needs reconciliation after this security backport. Do not create a release tag in this PR.

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review or merge it after the required checks pass.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 52df8e04-bddb-4094-abcc-b41621a90ddb

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 01023c0...8b6ad48 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 30, 2026 9:18a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/google-cloud-skills-boost-helper/actions/runs/41032336667

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI updated: 2026-10-30T09:18:23Z
CI attempt: #1
Approval workflow: #625.1

CI run: https://github.com/ePlus-DEV/google-cloud-skills-boost-helper/actions/runs/41032336667

[github-actions]

Thanks for helping make Google Cloud Skills Boost - Helper better!