Repository navigation
Tabitha Workspaces 1.17.1 updates two development dependencies for published security fixes: sharp 0.35.5 (GHSA-wq5f-xc86-pv6w) and source-map-js 1.2.2 (GHSA-68fv-2mgg-jv7q).
Application code, runtime dependencies, browser permissions and library schema are unchanged. Locally rebuilt Chrome and Firefox ZIP contents match the public 1.17.0 packages apart from the manifest version.
Node-forge 1.4.0 remains in development-only web-ext/adbkit tooling with GHSA-86w9-cpqp-85rv; no patched version was listed at review time. Use trusted inputs in isolated builds and avoid unnecessary Android debugging. The full development audit remains open; the production dependency audit reports zero findings. The alerts alone do not establish compromise or runtime exploitability.
Independent review, 100 tests, strict types, both browser builds, manifest checks, Firefox lint and all three ZIP packages passed. Firefox lint has no errors and one existing bundled-code warning. Installed-browser and live WebDAV-provider acceptance remain unverified.