Take MarkSyncr from its release, not from Google's queue - #123
Merged
Merged
Conversation
The bundled MarkSyncr came from the Chrome Web Store's published CRX, which tied this bundle to Google's review queue. A fix released upstream does not reach the published CRX until a reviewer approves it, so v3.15.0 shipped a vault import that had already been fixed. It is silent too: the build succeeds and nobody learns the bundled copy is behind until a user hits the old bug. Right now that gap is open again. MarkSyncr 0.8.42 carries a Bitwarden JSON import fix and 0.8.43 makes that import fast, and the store still serves 0.8.41 because 0.8.42 is in review and 0.8.43 is queued behind it. A TronBrowser release today would bundle the same 0.8.41 it already has. MarkSyncr now attaches its built ZIP to its GitHub release, so this prefers that: the same artifact, published the moment a version is tagged, with no third party in the path. The store stays as a fallback, because losing the bundled extension entirely would be worse than bundling an older one. The fetch also reports which version it got, and says when it came from the store and may therefore lag. Not knowing that is precisely how v3.15.0 went out. Verified with no release asset published yet: it falls back and prints "fetched MarkSyncr 0.8.41 (CWS ..., may lag behind the release)". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
ThreatCrush Security Scan52 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 28 | LOW: 21
…and 2 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Take MarkSyncr from its release, not from Google's queue
The bundled MarkSyncr came from the Chrome Web Store's published CRX, which tied
this bundle to Google's review queue. A fix released upstream does not reach the
published CRX until a reviewer approves it, so v3.15.0 shipped a vault import
that had already been fixed. It is silent too: the build succeeds and nobody
learns the bundled copy is behind until a user hits the old bug.
Right now that gap is open again. MarkSyncr 0.8.42 carries a Bitwarden JSON
import fix and 0.8.43 makes that import fast, and the store still serves 0.8.41
because 0.8.42 is in review and 0.8.43 is queued behind it. A TronBrowser release
today would bundle the same 0.8.41 it already has.
MarkSyncr now attaches its built ZIP to its GitHub release, so this prefers that:
the same artifact, published the moment a version is tagged, with no third party
in the path. The store stays as a fallback, because losing the bundled extension
entirely would be worse than bundling an older one.
The fetch also reports which version it got, and says when it came from the store
and may therefore lag. Not knowing that is precisely how v3.15.0 went out.
Verified with no release asset published yet: it falls back and prints
"fetched MarkSyncr 0.8.41 (CWS ..., may lag behind the release)".
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com