build(deps): drop the adm-zip overrides pin - upstream ranges now reach 0.6.0 (#72)
Some checks failed
CI / MCP server (push) Has been cancelled
CI / Browser extension (push) Has been cancelled

Both upstream gates from #58 have cleared since it was filed:

  firefox-profile@4.7.1  → adm-zip ~0.6.x   (was ~0.5.x)
  web-ext@10.6.0         → firefox-profile 4.7.1 (was exact 4.7.0)

adm-zip latest is 0.6.0, so firefox-profile's own ~0.6.x range now
resolves the patched 0.6.0 without the forced override. Removing the
adm-zip entry leaves resolution byte-identical: `npm install
--package-lock-only` produces no lockfile change and the tree still
resolves adm-zip@0.6.0. The brace-expansion / shell-quote overrides are
unrelated and stay.

Verified locally: npm ci (exit 0), npm run build, node build.js validate
(chrome+firefox pass), node test-extension.js, npx web-ext lint (0 errors).
GHSA-xcpc-8h2w-3j85 no longer appears in npm audit.

Closes #58.

Co-authored-by: aaronjmars <aaronjmars@users.noreply.github.com>
This commit is contained in:
@aaronjmars 2026-08-24 14:51:03 -04:00 • committed by GitHub
parent efda0f8e63
commit 53fb3ce370
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -26,7 +26,6 @@
"web-ext": "^10.6.0"
},
"overrides": {
"adm-zip": "^0.6.0",
"brace-expansion": "^1.1.16",
"shell-quote": "^1.9.0"
}