Update package-lock.json using npm audit fix as security update

[PeterDaveHello]

Summary

• Refresh transitive dev, build, and test dependencies with the non-force
  npm audit fix result.
• Upgrade Less from 4.2.0 to 4.9.0, replacing its legacy image-size path
  with the updated probe-image-size dependency chain.
• Keep the security update lockfile-only and avoid npm audit fix --force,
  which would apply breaking direct-dependency changes.

No extension source, manifest, or user-facing behavior changes are included.

Audit impact

Severity	Before	After
Low	4	4
Moderate	1	1
High	10	4
Total	15	9

The remaining findings require npm audit fix --force and breaking dependency
changes, so they are intentionally outside this focused update.

Validation

• npm audit --package-lock-only — 15 vulnerabilities before, 9 after
• npm ci --ignore-scripts --dry-run — passed
• npm run pretty — package-lock.json unchanged
• npm run lint — passed
• npm test — 60 passed
• npm run build — passed
• Chromium and Firefox build artifacts — verified
• Manual browser smoke tests — not run; this terminal-only environment cannot
  load unpacked browser extensions, and the change is lockfile-only

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: cd5799fe-9ee2-4aeb-bc96-871194f5881a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Refresh transitive dependencies to reduce audit vulnerabilities

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Refresh transitive development dependencies using non-breaking npm audit remediation.
• Upgrade Less and replace its legacy image-size dependency chain.
• Reduce audit findings while deferring breaking direct-dependency upgrades.

Diagram

graph TD
  A["npm audit fix"] --> B["Package lock"] --> C["Less 4.9"] --> D["Probe image size"]
  B --> E["Patched utilities"]
  B --> F["Audit findings"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Apply forced audit remediation

• ➕ Could address additional remaining audit findings immediately.
• ➖ Introduces breaking direct-dependency upgrades.
• ➖ Expands scope beyond a lockfile-only security refresh.
• ➖ Requires broader compatibility and browser-extension regression testing.

2. Upgrade direct dependencies explicitly

• ➕ Makes security upgrades visible in package.json.
• ➕ Allows deliberate migration and compatibility planning.
• ➖ Requires a separate breaking-change assessment.
• ➖ Would delay the safe transitive vulnerability reduction available now.

Recommendation: Keep the current non-force, lockfile-only remediation for this focused security update. Handle remaining findings through a separate direct-dependency upgrade PR with explicit migration and regression testing.

Files changed (1) +154 / -79

Other (1) +154 / -79

package-lock.jsonRefresh audited transitive dependency versions +154/-79

Refresh audited transitive dependency versions

• Regenerates the lockfile with non-force npm audit remediation, including Less 4.9.0 and patched utility releases. Replaces Less's legacy image-size path with probe-image-size and removes obsolete transitive packages, reducing total audit findings from 15 to 9.

package-lock.json

[pullfrog]

✅ No new issues found.

Reviewed changes

• Lockfile-only npm audit fix bunk — only package-lock.json changes; package.json, source, manifest, and runtime behavior are untouched.

This is a clean, well-scoped security update. The changes are all transitive dev/build/test dependencies:

• less 4.2.0 → 4.9.0 (peer of less-loader ^11), replacing the legacy image-size path with probe-image-size/stream-parser.
• make-dir 2.1.0 → 5.1.0, dropping pify and the nested semver (engines >=6 → >=18 — compatible with this repo's node >=22 requirement).
• copy-anything/is-what and patch bumps for fast-uri, js-yaml, nanoid, brace-expansion, undici.

All bumped packages sit in the dev/peer/optional tree (build tooling only), so the engine bumps and dependency re-wiring have no runtime surface. Sticking with the non-force audit fix and deferring the remaining findings that would require breaking direct-dependency changes is the right call. Build, lint, and the 60-passing tests reported in the PR align with this being mergeable as-is.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗