[hoangsvit]

Summary

Security hardening pass for the dependency tree before promoting dev to main.

Changes

• upgrade wxt from 0.20.27 to 0.21.4;
• upgrade @wxt-dev/auto-icons from 1.1.0 to 1.1.2;
• upgrade @wxt-dev/module-react from 1.1.5 to 1.2.2;
• refresh and deduplicate transitive dependency resolutions in yarn.lock;
• resolve the vulnerable chains previously involving adm-zip, brace-expansion, node-forge, sharp, shell-quote, tmp, uuid, and related packages;
• resolve the final http-cache-semantics High advisory;
• keep the existing TypeScript behavior during the WXT 0.21 migration by explicitly setting verbatimModuleSyntax: false and noUncheckedIndexedAccess: false. A stricter TypeScript migration should be handled separately.

Security validation

yarn npm audit --recursive --severity moderate completes successfully after the refresh, so no Moderate/High/Critical npm advisories remain in the resolved dependency tree.

Regression validation

• TypeScript compile: pass
• Unit tests: 205 passed / 18 test files
• Chrome production build: pass
• Firefox production build: pass
• Production manifest scope verification: pass
• Website production build: pass

Branch flow

This PR targets dev. After CI passes and this PR is merged, dev will be promoted to main in a separate PR.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review / merge it when we are online.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e270df23-a51b-4d62-b39b-28013714fa8a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/37405703462

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

Approval refresh: #1
CI updated: 2026-10-06T02:46:28Z
CI attempt: #1
Approval workflow: #494.1

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/37405703462

[github-actions]

Thanks for helping make Gmail Alias Toolkit better!

[deepsource-io]

DeepSource Code Review

We reviewed changes in 0d5b10f...02669f3 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 6, 2026 2:45a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.