[Nawid3333]

Fixes Dependabot alerts #30 to #42: thirteen alerts (three high, six moderate, four low), from ten undici advisories. Every one is fixed from undici 6.28.1 on the 6 line and 7.29.1 on the 7 line. All are development-only: nothing from undici ships in the extension.

• fix(player): keep every seek inside the video, so MP4 keeps its buffer #30/Keep SRT cues with '.' or missing milliseconds and extra blank lines #31 (moderate): Denial of Service via unhandled error in WebSocket permessage-deflate decompression.
• Fix: the page's own <track> subtitles never reach the player #32 to test(e2e): pnpm run test:live, the playback checklist against real streams #42, published 2026-09-29: among them a TLS certificate validation bypass, DoS via an unrequested WebSocket subprotocol, cross-user cookie disclosure through Set-Cookie caching, and response splitting through the retry interceptor.

Why pnpm kept the old versions

undici 6.28.0 comes through webdriver 9.32.0, the e2e test driver (WebdriverIO), which asks for undici ^6.27.0. undici 7.29.0 comes through cheerio 1.2.0, pulled in by addons-linter 10.13.0, the Firefox add-on linter, which asks for ^7.19.0. Both of those ranges already allow the patched versions, but pnpm keeps the locked versions: pnpm update undici, also with --depth, and pnpm audit --fix update changed nothing. Dependabot's own security update ran twice today and ended in "update_not_possible", so it opened no PR.

Fix

Two overrides in pnpm-workspace.yaml, next to the existing Dependabot overrides and with the same kind of comment: undici@6: ^6.28.1 and undici@7: ^7.29.1. One per major, so webdriver keeps 6 and cheerio keeps 7.

In pnpm-lock.yaml: undici 6.28.0 -> 6.29.0 and 7.29.0 -> 7.30.0, nothing else changed. webdriver now loads undici 6.29.0 and cheerio 7.30.0. pnpm audit says "No known vulnerabilities found", but npm's audit data lists only #30/#31 so far. For #32 to #42 I checked every range of each GitHub advisory: none reaches 6.29.0 or 7.30.0.

No release: the extension's build is unchanged, so auto-release will find it identical to the latest release and skip.

Checked

• Before the push, on this branch rebased onto ci: update PRs merge themselves when they ship nothing, and report the rest #60: a frozen install, lint, typecheck, and the unit tests (616 passed, 2 skipped).
• e2e, on the same change before the rebase (ci: update PRs merge themselves when they ship nothing, and report the rest #60 changes only CI, tools and docs): verify passed on Windows (Firefox 156). verify:linux passed on Ubuntu 24.04 and 26.04 (Firefox 157), with one retry in mp4-fragmented-end, a known test-timing flake that passed on the retry. In test:live, everything passed except the two Shaka Angel One HLS cases. They fail the same way on main: the player opens one of the stream's .mp4 segments instead of the playlist. That is the feat(detection): find manifests by their Content-Type, and play the longest stream #50 regression fix(detection): a stream's .mp4 pieces no longer outrank its manifest #61 fixes.

🤖 Generated with Claude Code