[Nawid3333]

@Nawid3333 Today's Dependabot PRs (#22–#26) combined into one PR, so they go out as one release. It also includes the auto-release change you approved: no release when nothing shipped changed.

Updates taken

From	Update	Ships in the extension?
#22	pnpm/action-setup 6.0.10 → 6.1.0 (SHA checked against the annotated v6.1.0 tag)	no
#23	@types/chrome 0.3.0, @vitest/coverage-v8 5.0.1, @wdio/cli, local-runner and mocha-framework 9.32.0, @wdio/spec-reporter 9.32.0, eslint 10.11.0, vitest 5.0.1, web-ext 10.7.0	no
#23	pako 3.0.1 → 3.0.2: two upstream zlib fixes (Z_FIXED strategy, unsigned gzip header time); nothing else in dist/pako.mjs changed	yes
#24	globals 16 → 17	no
#26	geckodriver 6.1.1 → 7.0.0: a repository move and upstream's own tooling, no API change	no

Updates refused, and now ignored by Dependabot

• onnxruntime-web 1.20.0 → 1.30.0 (from build(deps-dev): bump the npm-minor-and-patch group with 11 updates #23). The voice detector runs a custom, stripped-down ONNX Runtime built from a 1.20-era commit, and only the 1.20.0 loader fits it. With 1.30.0, the voice-detection e2e test failed inside the runtime (checkLastError) on Linux and on Windows. Moving on means rebuilding that runtime (tools/reproduce-ort-wasm.sh).
• mp4-muxer 4.3.3 → 5.2.2 (build(deps-dev): bump mp4-muxer from 4.3.3 to 5.2.2 #25). This was already tried and reverted on 2026-09-06. 5.2.2 crashes when finalizing a video track that received no frames (track.info.decoderConfig is null); modules.e2e.mjs covers that case on purpose, and 4.3.3 handles it. 5.2.2 is the final release because upstream deprecated the library in favour of Mediabunny, so no fix can come.

Both reasons are written next to their entries in .github/dependabot.yml and in docs/vendored-libraries.md. checkPatchedUpdates.test.mjs now expects Dependabot's ignore list to be exactly the patched libraries plus these two, so a stale entry still fails the test.

Auto-release: no release when nothing shipped changed

Before bumping the version, auto-release.yml compares CI's build of the pushed commit (the faststream-bundles artifact) with the latest release's firefox-github-*.zip, file by file with diff -rq. If they are identical, the push changed only tools, tests, workflows, docs or dev dependencies, so the step prints a notice and nothing is released. Anything short of a clean "identical" releases as before: no release, no artifact, a missing run id, a failed download or unzip, any difference.

I checked it on real history before writing it:

Build	Compared with	Result
PR #21's merge (tooling only)	v1.3.82.32	identical → no release (v1.3.82.33 was indeed only a new version number)
PR #20's merge (dash.js, mp4box)	v1.3.82.31	6 files differ → release
PR #26's CI build (geckodriver only)	v1.3.82.33	identical → no release
PR #23's run (failed before uploading a build)	v1.3.82.33	cannot compare → release
empty run id	–	refused → release (without the guard, gh took another run's artifact)

To release a push like that anyway: pnpm run release <version>.

This PR changes pako, so merging it does release.

Verified locally

I ran the full pnpm run verify on this commit's tree in three environments:

	Ubuntu 24.04 (WSL)	Ubuntu 26.04 (WSL)	Windows 11
actionlint + shellcheck (the new auto-release step included)	clean	clean	-
Unit tests	310/310	310/310	310/310
e2e spec files (voice detection on ORT 1.20.0 included)	38/38	38/38	38/38
web-ext lint (both builds)	0 errors	0 errors	0 errors
Provenance (ORT, vtt, knob, VAD)	verified	verified	verified

I also compared this commit's local build with v1.3.82.33, the same way auto-release will: only player/modules/pako.mjs differs.

🤖 Generated with Claude Code