LinkedIn Enhancer

Added

• Per-category hidden counters in the popup and side panel. Each of the four "hide" toggles (sponsored posts, LinkedIn ads, post suggestions, profile recommendations) now shows a count pill of how many items it has removed on the active tab, breaking down the single total already painted on the toolbar icon. The counts are cumulative: because LinkedIn virtualizes the feed (off-screen posts are dropped from the DOM), each item is counted once the moment it is hidden and the running total keeps climbing as you scroll, rather than shrinking. Toggling a category off restores its items and resets its counter. A separator was also added before the relationship-status toggle for visual grouping.

Security

• Build leak gate (pnpm security:build). A dependency-free script (scripts/check-build-security.mjs) scans every production build dir and fails if it ships a source map (.map, external sourceMappingURL, or inline map / sourcesContent), an original source file, dev-server / HMR code (localhost:3000, vite-hmr, …) or an absolute dev path. It runs in pnpm validate and as a hard stop in the release workflow before anything is published, so a release can never leak source maps or code.

Removed

• Dropped Safari support. Packaging a Safari Web Extension requires Xcode, and the MV3 migration it would need (for the stop-feed-refresh world: 'MAIN' content script) leaked the sidePanel config through a WXT browser-detection quirk. All Safari targets, scripts, permissions and docs were removed. The extension now targets Chrome, Edge, Opera, Brave and Firefox.

Changed

• Firefox is now built as Manifest V3. The stop-feed-refresh tool needs a world: 'MAIN' content script to override LinkedIn's page from inside its strict CSP, and world: 'MAIN' only exists in MV3. Firefox 128+ supports it (already the strict_min_version), so the feature now works on Firefox too. Chrome / Edge / Opera / Brave / Firefox are fully supported. CI builds all four browser targets.

Added

• Update notifier. Because the extension is installed manually (no store), the background periodically (via chrome.alarms) checks a public releases manifest and shows a one-time notification per version when a newer build is available, linking to the releases page. The options page shows the installed version and a "Check for updates" toggle to disable it entirely. Logic in src/lib/update-check.ts.

Security

• The extension now makes ONE outbound network request: an anonymous update check. It fetches a public static JSON (…/josedacosta-extensions-releases/…/extension.json) with no query string and no identifier, reading only latestVersion. This relaxes the previous "never phones home" posture; it is opt-out via the checkForUpdates setting and documented in PRIVACY.md. New alarms + notifications permissions back the feature.

Fixed

• Relationship badge now lands on the post author, not the resharer. On "X liked/commented on this" posts, the badge could attach to the reactor (e.g. a followed company) while showing the author's follow state — so it read "Non abonné" next to a page you actually follow. The 3rd-degree token is rendered "3e et +", which the degree matcher missed (length + missing "et +"), causing the fallback to the wrong actor. The matcher now accepts "3e et +" / "3rd+", so the badge anchors on the author's degree and reflects their relationship. (The notification level — the bell's "All / Most relevant / Off" — is not present in the feed HTML, so it cannot be shown per post.)

Added

• Update notifier. Because the extension is installed manually (no store), the background periodically (via chrome.alarms) checks a public releases manifest and shows a one-time notification per version when a newer build is available, linking to the releases page. The options page shows the installed version and a "Check for updates" toggle to disable it entirely. Logic in src/lib/update-check.ts.

Security

• The extension now makes ONE outbound network request: an anonymous update check. It fetches a public static JSON (…/josedacosta-extensions-releases/…/extension.json) with no query string and no identifier, reading only latestVersion. This relaxes the previous "never phones home" posture; it is opt-out via the checkForUpdates setting and documented in PRIVACY.md. New alarms + notifications permissions back the feature.

Fixed

• Relationship badge now lands on the post author, not the resharer. On "X liked/commented on this" posts, the badge could attach to the reactor (e.g. a followed company) while showing the author's follow state — so it read "Non abonné" next to a page you actually follow. The 3rd-degree token is rendered "3e et +", which the degree matcher missed (length + missing "et +"), causing the fallback to the wrong actor. The matcher now accepts "3e et +" / "3rd+", so the badge anchors on the author's degree and reflects their relationship. (The notification level — the bell's "All / Most relevant / Off" — is not present in the feed HTML, so it cannot be shown per post.)