action-allowlist-review: bump browser-actions/setup-firefox from 1.7.1 to 1.7.2 in /.github/actions/for-dependabot-triggered-reviews

[dependabot]

Bumps browser-actions/setup-firefox from 1.7.1 to 1.7.2.

Release notes

Sourced from browser-actions/setup-firefox's releases.

setup-firefox: v1.7.2

1.7.2 (2026-05-06)

Bug Fixes

• drop 32-bit arch support (#645) (c5cfea2)
• update Node.js runtime to v24 LTS (#642) (4eb4a82)
• upgrade dev dependencies (@actions/*, biome v2, vitest v4, @​vercel/ncc) (#644) (59e1322)

v1.7.2

1.7.2 (2026-05-06)

Bug Fixes

• drop 32-bit arch support (#645) (c5cfea2)
• update Node.js runtime to v24 LTS (#642) (4eb4a82)
• upgrade dev dependencies (@actions/*, biome v2, vitest v4, @​vercel/ncc) (#644) (59e1322)

Changelog

Sourced from browser-actions/setup-firefox's changelog.

Changelog

1.7.2 (2026-05-06)

Bug Fixes

• drop 32-bit arch support (#645) (c5cfea2)
• update Node.js runtime to v24 LTS (#642) (4eb4a82)
• upgrade dev dependencies (@actions/*, biome v2, vitest v4, @​vercel/ncc) (#644) (59e1322)

1.7.1 (2026-02-21)

Bug Fixes

• bump node version (#638) (6671e17)

1.7.0 (2025-07-27)

Features

• Support Linux ARM64 (#637) (c1a8cea)

Bug Fixes

• add .exe to firefox-path on Windows (#635) (6a1b4a4)

1.6.0 (2025-07-13)

Features

• Support windows 11 arm (#631) (5db7048)

1.5.4 (2025-01-25)

Bug Fixes

• Fix an off-by-one error with bz2/xz download URLs (#626) (f7574dd), closes #625

1.5.3 (2025-01-19)

Bug Fixes

• Coping with compression change for linux download (#623) (063eed6)

... (truncated)

Commits

• 0bc507d Release v1.7.2 at b2420b5fc5c9410c3bb4558ea29f202e52b4f41e
• See full diff in compare view

[hen]

Comparing the old and new versions, the index.js for the new version is dramatically larger (8K lines to 35K lines) without an obvious commit. Without digging too deeply, it seems like updating dev dependencies may have inlined a lot of new code. Looking at GitHub metrics, this action seems fairly obscure (stars, forks etc), though the commits that have been applied since 1.7.1 look sensible. It's only the surprise leap in built index.js that raises the eyebrow.

[potiuk]

Marking it as suspicious.

I do not like this action:

• Huge changes in single commit (40K changes)
• Single-person shop releasing those browser actions

I am running analyze skill on it

[potiuk]

I ran verify-action-build against this dependabot bump and the only failure is Lock file presence — package.json (just {"type": "module"}) has no matching lock file.

That package.json declares zero dependencies, so a lock file would describe an empty graph. The check already skips dependency-less pyproject.toml and require-less go.mod for the same reason, but didn't have the equivalent skip for package.json. v1.7.0 and v1.7.1 were approved before the lock-file check landed in #770; once it landed, this whole class of release-please-style bundled tags started bouncing.

Fix in flight at #816 — once that merges, re-trigger CI here and Lock file presence should pass. The other checks already pass: JS build verifies, downloads have verification.

[potiuk]

@dependabot rebase

[potiuk]

Comparing the old and new versions, the index.js for the new version is dramatically larger (8K lines to 35K lines) without an obvious commit. Without digging too deeply, it seems like updating dev dependencies may have inlined a lot of new code. Looking at GitHub metrics, this action seems fairly obscure (stars, forks etc), though the commits that have been applied since 1.7.1 look sensible. It's only the surprise leap in built index.js that raises the eyebrow.

Ok. The "verify" passes now - it correctly detects that the .js in the action is not compiled but comes from the commit. And being orphan branch stripped from everything else - we definitely need to take a closer look and possibly run deeper inspection with agent.... tomorrow.