From b91dcc21fbcd8655c8b1321b6292edbbebfd5591 Mon Sep 17 00:00:00 2001 From: TheStreamCode Date: Tue, 22 Sep 2026 20:10:04 +0200 Subject: [PATCH 1/2] docs: link webview CSP test from README Privacy section The colocated node:test suite (src/test/) already runs in CI via npm run check, so no test-layout change is needed. This closes the remaining review P1 by pointing readers at the CSP-nonce coverage in src/test/webviewBootstrap.test.ts. --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 4463556..01bd158 100644 --- a/README.md +++ b/README.md @@ -87,6 +87,7 @@ Settings changes for refresh interval and status bar visibility apply immediatel - The extension uses the key only to request your own usage data. - The extension does not keep a local history of usage data. - The webview persists only whether the Plan Limits section is collapsed, never an account snapshot. +- The webview loads its bootstrap as an ES module script with a CSP nonce (covered by `src/test/webviewBootstrap.test.ts`). - On uninstall, the extension performs best-effort cleanup of its local extension storage. ## Latest Changes From a22a14beafaa2b79df29494702be77cf90ecb301 Mon Sep 17 00:00:00 2001 From: TheStreamCode Date: Tue, 22 Sep 2026 20:40:53 +0200 Subject: [PATCH 2/2] fix: resolve npm audit failures blocking CI --- package-lock.json | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index b9b5e91..a331768 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2465,9 +2465,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { @@ -3238,13 +3238,14 @@ } }, "node_modules/qs": { - "version": "6.15.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", - "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "dev": true, "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.1.0" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { "node": ">=0.6" @@ -3498,15 +3499,15 @@ } }, "node_modules/side-channel": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz", - "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", "dev": true, "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3", - "side-channel-list": "^1.0.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" },