Skip to content

Release 2026070700#312

Merged
stophecom merged 6 commits into
mainfrom
dev
Jul 7, 2026
Merged

Release 2026070700#312
stophecom merged 6 commits into
mainfrom
dev

Conversation

@stophecom

@stophecom stophecom commented Jul 7, 2026

Copy link
Copy Markdown
Owner
  • Add browser extensions
  • Dependency updates

stophecom and others added 6 commits July 7, 2026 08:07
@stophecom @claude
feat(extension): add cross-browser secret-sharing extension
efb5392 
Adds apps/extension, a WXT + Svelte 5 browser extension (Chrome MV3 +
Firefox) that creates an encrypted, one-time-view secret link in one
click. It's a thin UI over @scrt-link/client — all client-side crypto and
the POST /api/v1/secrets call are reused, no backend changes.

- Authenticates with a personal API key stored in browser.storage.local
- Onboarding, create-secret, and key-settings screens
- Brand-matched styling (navy/cream/red) and inlined flame logo
- Wires apps/* into the pnpm workspace
- Ignores WXT-generated .wxt/.output dirs in the root ESLint config

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@stophecom @claude
fix(extension): declare AMO data-collection permissions for Firefox
c9cbeb1 
Firefox now rejects new submissions without
browser_specific_settings.gecko.data_collection_permissions. scrt.link is
zero-knowledge (secrets are E2E-encrypted, API key stays local), so we
declare `required: ["none"]`. Scoped to the Firefox build via a
per-browser manifest so Chrome doesn't emit an unrecognized-key warning.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@stophecom @claude
docs(extension): drop stale store-submission TODO from README
4a7c449 
Icons are now included; the remaining store-listing items live in the PR
description.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@stophecom
Merge pull request #310 from stophecom/feat/browser-extension
e5a8d5f 
feat(extension): cross-browser secret-sharing extension
@stophecom @claude
chore(deps): update aws-sdk to ^3.1081.0
fb58cc0 
Bump @aws-sdk/{client-s3,s3-presigned-post,s3-request-presigner} from
^3.772.0 to ^3.1081.0. This drops the transitive fast-xml-parser
dependency, resolving the critical Dependabot alert (entity-encoding
bypass via regex injection in DOCTYPE entity names).

pnpm auto-added the new AWS SDK versions to minimumReleaseAgeExclude in
pnpm-workspace.yaml so they pass the supply-chain release-age policy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@stophecom
Merge pull request #311 from stophecom/chore/update-aws-sdk
f5983b2 
chore(deps): update aws-sdk to ^3.1081.0
@stophecom stophecom self-assigned this Jul 7, 2026
@vercel

vercel Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
scrt-link-v2 Building Building Jul 7, 2026 8:38pm
scrt-link-v2 (dev) Ready Ready Preview, Comment Jul 7, 2026 8:38pm

Request Review

@socket-security

socket-security Bot commented Jul 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​wxt-dev/​module-svelte@​2.0.5701007387100
Addedwxt@​0.20.27971009393100
Updated@​aws-sdk/​client-s3@​3.980.0 ⏵ 3.1081.099 +2100100 +198 +1100
Updated@​aws-sdk/​s3-presigned-post@​3.980.0 ⏵ 3.1081.099 +110010098 +1100
Updated@​aws-sdk/​s3-request-presigner@​3.980.0 ⏵ 3.1081.0100 +110010098 +1100

View full report

@socket-security

socket-security Bot commented Jul 7, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/wxt@0.20.27 → npm/@pnpm/network.ca-file@1.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm commander is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/wxt@0.20.27 → npm/commander@9.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/commander@9.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm cssom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/cssom@0.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cssom@0.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm htmlparser2 is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/htmlparser2@10.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/htmlparser2@10.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm node-fetch-native is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/wxt@0.20.27 → npm/node-fetch-native@1.6.7

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-fetch-native@1.6.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm node-forge is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/wxt@0.20.27 → npm/node-forge@1.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-forge@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm powershell-utils is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/wxt@0.20.27 → npm/powershell-utils@0.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm yargs is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/wxt@0.20.27 → npm/yargs@17.7.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@stophecom stophecom merged commit efd40f0 into main Jul 7, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@stophecom stophecom

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stophecom