[dependabot]

Refresh stabilized provider, media, Preact, WXT, and Oxc dependencies while retaining Node 24 and the seven-day adoption hold.

Finish the googlevideo 5 migration across the complete browser adapter: preserve credentialed requests and audio-track identity, provide the required video/playback settings, read binary views without losing byte offsets, and await cleanup without masking the original error. Regression tests cover binary views, audio-track mapping, fetch credentials, and asynchronous cleanup.

Exclude linkedom 0.18.14 because its CSSOM browser entry has no named parse export and breaks the production extension build. Keep 0.18.13 eligible and allow the corrected 0.18.15 line after its existing cooldown (eligible November 8). No security override is removed or downgraded.

Document why the unpatched deepmerge advisory is unreachable here: only the development linter uses it, merging bundled schemas and fixed patches. Alert #140 was dismissed as not used after inspecting the shipped call sites.

Validation: pnpm run check passed (3,880 tests, 49 optional skips); Chrome production build and Firefox extension smoke passed. The SABR regressions fail with the old adapter and pass after migration. No release, tag, or version bump.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR updates 14 dependency families used by the CLI, core library, Chrome extension, and development tooling.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful maintenance direction, but the major dependency upgrade is incomplete and fails exact-head validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored maintenance PR is outside the ordinary contributor proof gate; no changed-path runtime demonstration is claimed.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes
User problem: Users benefit from upstream rendering, media, parsing, and provider fixes while established extension behavior remains compatible.
Reason: This continues the repository's established stabilized-dependency refreshes without adding product options or public APIs.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep this PR open for repair: the dependency refresh is useful, but GoogleVideo 5 changes the SABR API without updating its caller and introduces a confirmed lint failure.

Priority: P2
Reviewed head: a5bf53397e3c3fda010537f51d53b461e9324633

Before merge

• [P1] Retain GoogleVideo 4 until the SABR caller is migrated (P1) - Upgrading to 5.0.1 leaves downloadViaSabr on the version-4 contract. The new constructor reads fetchFunction instead of fetch, so the wrapper adding credentials: include is ignored; its types also require videoId, and start requires isPostLiveDvr. abort now returns a Promise, which already causes the exact-head no-floating-promises failure at youtube-audio.ts:230. This dependency bump therefore breaks validation and changes credential handling when direct audio fails and SABR is selected. Keep 4.1.1 here, or migrate the complete caller contract together rather than suppressing the lint diagnostic.
• Explain or restore the original intent of GoogleVideo-backed SABR fallback - a0de79b: The original feature retained captured SABR playback as a secondary audio-download path; the grouped update supplies no caller migration for the upstream rewrite.

Findings

• [P1] [P1] Retain GoogleVideo 4 until the SABR caller is migrated — apps/chrome-extension/package.json:27

Provenance

• GoogleVideo-backed SABR fallback changes intended behavior without addressing why it exists (a0de79b: The original feature retained captured SABR playback as a secondary audio-download path; the grouped update supplies no caller migration for the upstream rewrite.)

Tests

• Missing end-to-end proof: Chromium scenarios never ran because the extension build failed, and coverage and extension typechecking were skipped after lint failed; the build diagnostic could not be inspected through the permitted log host.

Agent review details

How this fits together

Workspace manifests and the lockfile select libraries that turn fetched content into summaries, render terminal and browser output, download YouTube audio, and build the extension.

flowchart TD
  A[Workspace manifests] --> B[Dependency lockfile]
  B --> C[CLI and core libraries]
  B --> D[Chrome extension]
  B --> E[Build and lint tools]
  D --> F[YouTube SABR audio]
  C --> G[Summary output]
  F --> G

Loading

Technical review

Best possible solution:

Retain GoogleVideo 4.1.1 in this refresh and handle its SABR migration separately while preserving credentialed audio downloads.

Do we have a high-confidence way to reproduce the issue?

Pinned upstream source and the unchanged caller establish the API mismatch, and exact-head CI confirms its asynchronous-abort lint failure; no target code was executed locally.

Is this the best way to solve the issue?

The dependency refresh follows established maintenance direction, but deferring the incompatible major upgrade is the smallest complete repair for this PR.

Full review comments:

• [P1] [P1] Retain GoogleVideo 4 until the SABR caller is migrated — apps/chrome-extension/package.json:27
  Upgrading to 5.0.1 leaves downloadViaSabr on the version-4 contract. The new constructor reads fetchFunction instead of fetch, so the wrapper adding credentials: include is ignored; its types also require videoId, and start requires isPostLiveDvr. abort now returns a Promise, which already causes the exact-head no-floating-promises failure at youtube-audio.ts:230. This dependency bump therefore breaks validation and changes credential handling when direct audio fails and SABR is selected. Keep 4.1.1 here, or migrate the complete caller contract together rather than suppressing the lint diagnostic.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e1f209e1a9bd.

Provenance checked

• Stabilized runtime and tooling versions keeps the original intent (e1f209e: The previous refresh intentionally retained Node 24, security overrides, and the seven-day hold.)

Testing

Proof path: none.

Security

None.

Evidence

Acceptance criteria:

• pnpm install --frozen-lockfile
• pnpm run check
• pnpm -C apps/chrome-extension build
• pnpm -C apps/chrome-extension test:chrome

What I checked:

• Pinned dependency change: The introduced diff upgrades googlevideo from 4.1.1 to 5.0.1 while changing no application source. (apps/chrome-extension/package.json:27, a5bf53397e3c)
• Unmigrated production caller: downloadViaSabr still supplies fetch and durationMs, omits the new required videoId and isPostLiveDvr fields, and calls abort without awaiting its new Promise result. (apps/chrome-extension/src/entrypoints/offscreen/youtube-audio.ts:203, a5bf53397e3c)
• Authoritative dependency contract: The target imports and executes SabrStream from this dependency; version 5.0.1 reads fetchFunction instead of fetch and declares abort async. The breaking rewrite is explained at refactor(SabrStream): Rewrite & add livestream support LuanRT/googlevideo#54. (src/core/SabrStream.ts:133, 35b2b4e51103)
• Required API fields: SabrStreamConfig requires videoId and accepts fetchFunction; SabrPlaybackOptions requires isPostLiveDvr. (src/types/sabrStreamTypes.ts:16, 35b2b4e51103)
• Confirmed diff-caused lint failure: The exact-head test check reports no-floating-promises at youtube-audio.ts:230, matching Google's newly asynchronous abort contract; coverage and extension typechecking were subsequently skipped. Check: https://github.com/steipete/summarize/actions/runs/41779316737/job/126406965788. (apps/chrome-extension/src/entrypoints/offscreen/youtube-audio.ts:230, a5bf53397e3c)
• Separate build failure remains unattributed: The Chromium job failed during Build extension before browser tests ran. Its annotations provide no diagnostic, and the log download redirects to a host blocked by the review environment; no cause is assigned. Check: https://github.com/steipete/summarize/actions/runs/41779316737/job/126406965805. (.github/workflows/ci.yml, a5bf53397e3c)

Labels

Label changes:

• add P2: Routine dependency maintenance has a concrete repairable compatibility defect, without evidence of an urgent released outage.
• add merge-risk: 🚨 compatibility: GoogleVideo 5 changes the constructor, playback options, and abort contract consumed by the existing extension.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: Routine dependency maintenance has a concrete repairable compatibility defect, without evidence of an urgent released outage.
• merge-risk: 🚨 compatibility: GoogleVideo 5 changes the constructor, playback options, and abort contract consumed by the existing extension.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 4, 2026, 12:40 AM ET / 05:40 UTC.