elliptic (open advisories, no fixed version) came only through
crypto-browserify, the webpack fallback for node's crypto. Nothing in
the extension uses it: the only 'elliptic' in the built files is a word
in zxcvbn's dictionary. Without the fallback the chrome and firefox
builds contain the same modules with the same bodies; only webpack's
module ids and their order change (one browser-field-ignored module is
now resolved from a different request). A future crypto import now
fails the build instead of shipping a polyfill.
braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
The diff step rebuilds the extension from master-ff-src.zip (the source
archive AMO reviews) and compares the result with our build. It had never
worked, which the removed continue-on-error was hiding:
- The source zip left out .yarn/releases (yarnPath points there, so yarn
could not start in the unpacked source) and scripts/ (build:ff runs
scripts/postbuild-cleanup.cjs). Both are now included.
- diff.sh used `[ a || b ]`, which is not valid test syntax, and piped
`diff -qr` into `sort`, so the check exited 0 whatever diff found. It now
goes by diff's own exit status; with a file altered it fails.
- With those fixed, the builds still differed: webpack inlined
import.meta.url from @pezkuwi/* packageInfo.js as the absolute file://
path of the build machine, which also put our build directory into the
published extension. DefinePlugin now gives it a fixed value; it is only
shown in duplicate-version warnings.
Also fail-fast: false on the matrix. Without continue-on-error, the first
red step cancelled the others, so their results were lost.
Checked locally with node_modules as locked: "Builds are identical".
- New Firefox extension ID for AMO
- Fixed data_collection_permissions for Mozilla compliance
- Updated webpack config for ES2022 target
- Added firefox-postprocess.sh script
- Bumped all packages to 0.62.18
- Update all copyright headers from 2025 to 2026
- Fix @polkadot references to @pezkuwi in config files
- Fix eslint.config.js import path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Satoshi Qazi Muhammed