chore(security): promote audited dependency updates to main

[hoangsvit]

Summary

Promote the audited dependency security hardening from dev to main.

Included

• WXT 0.20.27 → 0.21.4;
• @wxt-dev/auto-icons 1.1.0 → 1.1.2;
• @wxt-dev/module-react 1.1.5 → 1.2.2;
• refreshed/deduplicated transitive dependency tree;
• resolved the previously reported vulnerable chains, including the Critical shell-quote advisory and the final High http-cache-semantics advisory;
• TypeScript compatibility overrides for the WXT 0.21 migration.

Security validation

yarn npm audit --recursive --severity moderate passes with no Moderate/High/Critical npm advisories in the resolved tree.

Regression validation

• TypeScript compile: pass
• Unit tests: 205/205
• Chrome production build: pass
• Firefox production build: pass
• Manifest scope verification: pass
• Website production build: pass
• CodeRabbit: pass
• DeepSource: pass

Source PR into dev: #106.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d9d8a566-b68d-47eb-aecf-03ab874a0399

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review / merge it when we are online.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 0d5b10f...432b66e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 6, 2026 2:47a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

Preview removed

The temporary website preview for this pull request has been removed.

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/37405837143

[eplus-bot]

Approved by @eplus-bot after all pull request checks passed.

Approval refresh: #1
CI updated: 2026-10-06T02:48:11Z
CI attempt: #1
Approval workflow: #496.1

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/37405837143

[github-actions]

Thanks for helping make Gmail Alias Toolkit better!