#56 pinned adm-zip to ^0.6.0 with an overrides entry in opendia-extension/package.json to clear GHSA-xcpc-8h2w-3j85. That override is a stopgap and should come out once it is no longer needed.
Why it exists
There was no version to bump to. The dependency chain, at the time of #56:
web-ext@10.5.0 (latest)
└─ firefox-profile@4.7.0 (latest)
└─ adm-zip "~0.5.x" ← cannot reach the patched 0.6.0
firefox-profile pins the range to 0.5.x, so no upgrade anywhere in the tree reaches the patch and Dependabot could not open a PR. Forcing the resolution was the only way to take it.
Why an override is not where this should end
overrides silently rewrites a dependency's own declared range. If firefox-profile later moves to an adm-zip API that 0.6.x does not have, npm will still resolve 0.6.x and the failure surfaces at runtime in web-ext run, not at install time. It is a maintenance liability that nothing will flag on its own — hence this issue.
When to remove it
Once firefox-profile widens its adm-zip range to include >= 0.6.0 and web-ext picks up that version:
- Delete the
overrides block from opendia-extension/package.json.
- Regenerate the lockfile with npm 10 (CI runs Node 20 — regenerating with a newer npm can produce a lockfile that
npm ci rejects there).
- Confirm the resolved
adm-zip is still >= 0.6.0:
node -e "console.log(require('adm-zip/package.json').version)"
- Run the extension CI steps locally:
npm ci, npm run build, node build.js validate, node test-extension.js, npx web-ext lint --source-dir=dist/firefox --self-hosted.
Checking whether that has happened
npm view firefox-profile@latest version dependencies.adm-zip
npm view web-ext@latest dependencies.firefox-profile
If the printed range admits 0.6.0, this is ready to close.
Exposure in the meantime
Low, and unchanged by whether the override is present. adm-zip is devDependencies-only and never ships in dist/. Of firefox-profile's two call sites, only addExtension() parses an untrusted archive (new AdmZip(xpi) + extractAllTo), which requires web-ext run with a hostile .xpi; CI only runs web-ext lint. This is hygiene, not an incident — no rush, just don't let the override outlive its reason.
#56 pinned
adm-zipto^0.6.0with anoverridesentry inopendia-extension/package.jsonto clear GHSA-xcpc-8h2w-3j85. That override is a stopgap and should come out once it is no longer needed.Why it exists
There was no version to bump to. The dependency chain, at the time of #56:
firefox-profilepins the range to0.5.x, so no upgrade anywhere in the tree reaches the patch and Dependabot could not open a PR. Forcing the resolution was the only way to take it.Why an override is not where this should end
overridessilently rewrites a dependency's own declared range. Iffirefox-profilelater moves to anadm-zipAPI that 0.6.x does not have, npm will still resolve 0.6.x and the failure surfaces at runtime inweb-ext run, not at install time. It is a maintenance liability that nothing will flag on its own — hence this issue.When to remove it
Once
firefox-profilewidens itsadm-ziprange to include>= 0.6.0andweb-extpicks up that version:overridesblock fromopendia-extension/package.json.npm cirejects there).adm-zipis still>= 0.6.0:node -e "console.log(require('adm-zip/package.json').version)"npm ci,npm run build,node build.js validate,node test-extension.js,npx web-ext lint --source-dir=dist/firefox --self-hosted.Checking whether that has happened
If the printed range admits
0.6.0, this is ready to close.Exposure in the meantime
Low, and unchanged by whether the override is present.
adm-zipisdevDependencies-only and never ships indist/. Offirefox-profile's two call sites, onlyaddExtension()parses an untrusted archive (new AdmZip(xpi)+extractAllTo), which requiresweb-ext runwith a hostile.xpi; CI only runsweb-ext lint. This is hygiene, not an incident — no rush, just don't let the override outlive its reason.