Dependencies and security
- Updated runtime and development dependencies across the workspace, including React 19.3, Redux Toolkit 2.13, Radix UI, HLS playback, Vite, Vitest, and Storybook. Refreshed the transitive dependency lockfile.
- Updated the reproducible build toolchain to Node.js 22.23.4, npm 10.9.9, and pnpm 12.16.1. Retained pnpm's default release-age protections and explicit install-script policy.
- Updated the checkout, Node setup, and release GitHub Actions and pinned them to immutable commit revisions.
- Patched the Firefox lint tool's
deepmerge@4.3.1dependency against GHSA-gcqx-w48m-w2h4, with prototype-poisoning and merge-compatibility regression checks. The registry still reports this low-severity advisory because no upstream fixed release exists; the local patch is exercised by the security gate.
Validation
- All 293 unit, integration, and component tests passed, along with workspace typechecking, the security gate, and the Storybook build.
- The production dependency audit reports no vulnerabilities. There are no moderate, high, or critical advisories in the full dependency audit.
- All six MV2/MV3 archives, including the variants without the blocklist, built and passed archive integrity, contents, and version checks. Firefox lint reported zero errors and six existing warnings.
- A real stream passed discovery, preview, quality selection, and video/audio/subtitle downloading in Chromium 153 on macOS, with no runtime exceptions. FFmpeg decoded the saved MKV successfully.
- The vendored FFmpeg WebAssembly binary matches the current upstream
@ffmpeg/core@0.12.10release; its JavaScript loader matches after formatting.
Installation
- Chromium: extract
extension-mv3-chrome.zipand load the folder as an unpacked extension. - Firefox: the GitHub XPI archives are unsigned and can be loaded temporarily through
about:debugging. Firefox Add-ons distribution requires separate Mozilla signing and approval. - Browser minimum versions remain Firefox 128 and Chromium 111.