v0.4.5 — zero known vulnerabilities in the toolchain

Security

• All 16 open Dependabot alerts (5 critical, 6 high, 5 moderate) are closed — npm audit reports zero. Every one of them sat in the build toolchain; the only runtime dependency is Preact, so no vulnerable code was ever shipped to users or to the Chrome Web Store.
• Toolchain upgraded: WXT 0.19 → 0.20.27, Vitest 2.1 → 4.1, Vite 5.4 → 8.1 (the whole tree now shares one Vite; the audit flagged every Vite ≤ 6.4.2).
• Patched transitive build dependencies pinned via package.json overrides — tar, tmp, adm-zip, shell-quote, uuid, esbuild. Their parents (giget, web-ext-run, which serve wxt init templates and Firefox runs this project never uses) still ship the vulnerable ranges, so no wxt release fixes them.

Changed

• BREAKING (build only) WXT 0.20 removed the extensionApi option; it is gone from wxt.config.ts and the global chrome.* API is now typed through @types/chrome. No change to the extension's behaviour, permissions or manifest — verified by the full suite: 35 unit tests and 39/39 E2E checks against the built extension.