action-allowlist-review: bump browser-actions/setup-firefox from 1.7.1 to 1.7.2 in /.github/actions/for-dependabot-triggered-reviews

[dependabot]

Bumps browser-actions/setup-firefox from 1.7.1 to 1.7.2.

Release notes

Sourced from browser-actions/setup-firefox's releases.

setup-firefox: v1.7.2

1.7.2 (2026-05-06)

Bug Fixes

• drop 32-bit arch support (#645) (c5cfea2)
• update Node.js runtime to v24 LTS (#642) (4eb4a82)
• upgrade dev dependencies (@actions/*, biome v2, vitest v4, @​vercel/ncc) (#644) (59e1322)

v1.7.2

1.7.2 (2026-05-06)

Bug Fixes

• drop 32-bit arch support (#645) (c5cfea2)
• update Node.js runtime to v24 LTS (#642) (4eb4a82)
• upgrade dev dependencies (@actions/*, biome v2, vitest v4, @​vercel/ncc) (#644) (59e1322)

Changelog

Sourced from browser-actions/setup-firefox's changelog.

Changelog

1.7.2 (2026-05-06)

Bug Fixes

• drop 32-bit arch support (#645) (c5cfea2)
• update Node.js runtime to v24 LTS (#642) (4eb4a82)
• upgrade dev dependencies (@actions/*, biome v2, vitest v4, @​vercel/ncc) (#644) (59e1322)

1.7.1 (2026-02-21)

Bug Fixes

• bump node version (#638) (6671e17)

1.7.0 (2025-07-27)

Features

• Support Linux ARM64 (#637) (c1a8cea)

Bug Fixes

• add .exe to firefox-path on Windows (#635) (6a1b4a4)

1.6.0 (2025-07-13)

Features

• Support windows 11 arm (#631) (5db7048)

1.5.4 (2025-01-25)

Bug Fixes

• Fix an off-by-one error with bz2/xz download URLs (#626) (f7574dd), closes #625

1.5.3 (2025-01-19)

Bug Fixes

• Coping with compression change for linux download (#623) (063eed6)

... (truncated)

Commits

• 0bc507d Release v1.7.2 at b2420b5fc5c9410c3bb4558ea29f202e52b4f41e
• See full diff in compare view

[hen]

Comparing the old and new versions, the index.js for the new version is dramatically larger (8K lines to 35K lines) without an obvious commit. Without digging too deeply, it seems like updating dev dependencies may have inlined a lot of new code. Looking at GitHub metrics, this action seems fairly obscure (stars, forks etc), though the commits that have been applied since 1.7.1 look sensible. It's only the surprise leap in built index.js that raises the eyebrow.

[potiuk]

Marking it as suspicious.

I do not like this action:

• Huge changes in single commit (40K changes)
• Single-person shop releasing those browser actions

I am running analyze skill on it

[potiuk]

I ran verify-action-build against this dependabot bump and the only failure is Lock file presence — package.json (just {"type": "module"}) has no matching lock file.

That package.json declares zero dependencies, so a lock file would describe an empty graph. The check already skips dependency-less pyproject.toml and require-less go.mod for the same reason, but didn't have the equivalent skip for package.json. v1.7.0 and v1.7.1 were approved before the lock-file check landed in #770; once it landed, this whole class of release-please-style bundled tags started bouncing.

Fix in flight at #816 — once that merges, re-trigger CI here and Lock file presence should pass. The other checks already pass: JS build verifies, downloads have verification.

[potiuk]

@dependabot rebase

[potiuk]

Comparing the old and new versions, the index.js for the new version is dramatically larger (8K lines to 35K lines) without an obvious commit. Without digging too deeply, it seems like updating dev dependencies may have inlined a lot of new code. Looking at GitHub metrics, this action seems fairly obscure (stars, forks etc), though the commits that have been applied since 1.7.1 look sensible. It's only the surprise leap in built index.js that raises the eyebrow.

Ok. The "verify" passes now - it correctly detects that the .js in the action is not compiled but comes from the commit. And being orphan branch stripped from everything else - we definitely need to take a closer look and possibly run deeper inspection with agent.... tomorrow.

[raboof]

Tagging @derkoe who introduced this action in the only place it's used, https://github.com/apache/tapestry-5/blob/master/.github/workflows/build-pull-request.yaml

[benweidig]

It appears Tapestry no longer needs the action (and browser-actions/setup-geckodriver) , as the ubuntu-latest image already contains Firefox/Geckodriver according to https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md

[derkoe]

@raboof you can remove this from the allowlist - we use the built-in installs now

[raboof]

@raboof you can remove this from the allowlist - we use the built-in installs now

Nice, even better! Filed #818

[potiuk]

Closing this one then :)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.