Challenges Addressing Third-Party Library Policy in Add-on Submission

Add-ons addons.mozilla.org
,
1

Hello,

I fully understand and appreciate Firefox’s strong commitment to user privacy, and I am willing to address the issues regarding the consent screen and reducing unnecessary data collection.

However, the third point about providing the exact origin and unmodified official versions of all third-party libraries is quite challenging for me.

My add-on includes many libraries directly grabbed from GitHub or built through npm scripts. Some of these libraries do not provide ESM builds, so I had to use esbuild to compile or adjust them. Many of these libraries were included or built a long time ago, and I no longer remember the exact versions or build details.

Moreover, some libraries, like ffmpeg.core.js, were originally designed for Node.js environments. I had to modify them—such as adding custom functions to correctly load the wasm path—to make them work properly in the browser. Some modifications were even done directly on their minified code.

Additionally, I use a library called dom-inspector to imitate the devtools element inspector. Since the original author has not updated it for about six years, I modified some CSS and code to fit my preferences and requirements.

Given these situations, I’m unsure how to provide completely identical, unmodified official versions of these libraries, since some modifications were necessary to make the add-on compatible with Firefox, rather than arbitrary changes.

The add-on was originally copied from a Chrome extension and adapted to Firefox by modifying features unsupported in Firefox. Now being asked to provide these exact original libraries feels frustrating and confusing.

I sincerely want to continue supporting Firefox users with this add-on, which I have spent a year developing to solve real user problems.

I kindly ask for your understanding and guidance on how to proceed under these circumstances. Thank you

My extension: Getvid Video Downloader

2

I know you mean well, and you are just solving the immediate issues that came before you, but I’m sure it’s a nightmare for any reviewer that should review it.

See for example this article where they analyze malicious extensions which used a slightly modified jquery library to hide some “extra features”:

When you see an unsupported library on Github and you want to fix it and use it, then fork it instead, and release it on NPM under new name. Then import it to your project. With modern AI guiding you, it’s not hard at all, plus you may help others with similar issues.

Also, use Webpack for your project. It can import even the old libraries, and most library authors are making them especially Webpack compatible.

Regarding changes to the minified code :smiley: , well, you should really find the original code, or rewrite it yourself (again, you can use AI to help you, unless it’s something huge).

I hope this helps, but I realize this is likely not what you wanted to hear…