build(deps-dev): bump web-ext to remove stale ajv

[cursor]

Asana Task/Github Issue: Follow-up to dependency review for #2674

Description

Bumps web-ext to 10.2.0 so its addons-linter dependency resolves to 10.5.0, which pins ajv@8.20.0 and removes the nested addons-linter/node_modules/ajv@8.18.0 copy left by the direct ajv update.

Also updates the fake MV3 integration-test extension manifest with required Firefox metadata so the newer linter passes cleanly.

Testing Steps

• npm ls ajv --all
• npx web-ext lint --source-dir=integration-test/extension from injected/
• npm run test-unit --workspace=injected -- --random=false --filter='test-pages'

Checklist

Please tick all that apply:

• I have tested this change locally
• I have tested this change locally in all supported browsers
• This change will be visible to users
• I have added automated tests that cover this change
• I have ensured the change is gated by config
• This change was covered by a ship review
• This change was covered by a tech design
• Any dependent config has been merged

  

---

Note

Low Risk
Low risk: dependency bumps and test-only manifest metadata updates; main risk is CI/lint behavior changes due to updated web-ext/addons-linter toolchain.

Overview
Updates the dev tooling by bumping web-ext to 10.2.0 (and ajv to ^8.20.0 at the root), which refreshes transitive linter dependencies and removes older nested ajv copies in the lockfile.

Adjusts the MV3 fake integration-test extension manifest.json to include Firefox browser_specific_settings.gecko metadata so web-ext lint passes with the newer linter.

^{Reviewed by Cursor Bugbot for commit 43589a8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

[Beta] Generated file diff

Time updated: Fri, 22 May 2026 10:34:48 GMT

[github-actions]

Build Branch

Branch	pr-releases/jkt/auto/dependency-update-review-3dad
Commit	8676caa047
Updated	May 22, 2026 at 10:34:04 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/jkt/auto/dependency-update-review-3dad

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/jkt/auto/dependency-update-review-3dad")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/jkt/auto/dependency-update-review-3dad
git -C submodules/content-scope-scripts checkout origin/pr-releases/jkt/auto/dependency-update-review-3dad

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#8676caa0470d3ad98a81aef4b8b462eebfa88ddf

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "8676caa0470d3ad98a81aef4b8b462eebfa88ddf")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/jkt/auto/dependency-update-review-3dad
git -C submodules/content-scope-scripts checkout 8676caa0470d3ad98a81aef4b8b462eebfa88ddf

[cursor]

Web Compatibility Assessment

No web compatibility findings.

• injected/integration-test/extension/manifest.json lines 6-12, severity: info. The added Gecko-only browser_specific_settings and data_collection_permissions metadata is confined to the integration-test extension manifest. It does not alter injected runtime behavior, content script matching, run_at, frame coverage, wrappers, shims, or DOM interaction patterns. web-ext lint --source-dir integration-test/extension --output json reports 0 errors, 0 warnings, and 0 notices.
• injected/package.json line 60 and package-lock.json lines 10636-10676, severity: info. web-ext remains a dev-only dependency used by the fake-extension/test tooling path, not code bundled into page-injected scripts.

Security Assessment

No security findings.

• package.json line 46 and package-lock.json lines 23 and 2461-2499, severity: info. The ajv/addons-linter updates are devDependency/tooling-only and remove stale transitive packages such as node-notifier, growly, shellwords, and uuid from the lockfile. There are no changes to captured-globals.js, message bridge checks, native messaging transports, origin validation, postMessage, runtime API overrides, or remote-config handling.

Risk Level

Low Risk: this PR changes dependency metadata, a test-only extension manifest, and lockfile entries only; it does not touch shipped injected source or security-sensitive runtime surfaces.

Recommendations

No code changes required. Keep the targeted validation in CI for this PR class: web-ext lint --source-dir integration-test/extension --output json and npm run build --workspace=injected both pass locally for this revision.

  

_{Sent by Cursor Automation: Web compat and sec}