Extension Pulse, week of August 3: AMO will now try to build your Firefox add-on from source

Mozilla's add-ons review pipeline just grew a spine. As of the Firefox 153 WebExtensions API updates post (July 23, noticed in this window), AMO tries to reproduce your build from the source you submitted.

If the package has a package.json, add:

"scripts": {
  "build-for-amo": "npm ci && npm run build"
}

That's the example they want. Run it in a clean Node image before you upload. If the script needs a global binary you only have on your laptop, AMO will not have it, and a human will be staring at a failed job instead of rubber-stamping the zip.

This is the Firefox-shaped version of "show us the source," and it's overdue. Reviewers used to take it on faith that the minified bundle matched the repo. They don't, as of now.

Chrome 152 is moving

Early stable is August 12. Final beta August 19. Full stable August 25. Frozen in this train, as of last week: 100-byte setBadgeText, browser namespace gated on is_extension(), alarms.create({ name }).

A smaller CL that's easy to miss: DNR ruleset indexing dropped its data-decoder utility-process dependency (CL 7907524, merged July 30). That's an IPC hop gone on rule load, shipping 153. Ad-blocker authors won't see an API change; they'll see slightly less "why is my SW waking."

Chrome 161 / 162 / 163 dates appeared on Chromium Dash (January–February 2027). Calendar. Not news.

The spec finally said what a privileged context is

WEWG PR #905 merged July 30: formal definitions for privileged extension context, isolated world, and main world in the WebExtensions spec draft. This is the boring work that every later PR about "can I inject here" has to sit on.

If you've been hand-waving "isolated world" in a design doc, the spec now has sentences you can link. That's worth more than another chrome.tabs tweak.

Firefox 153 leftovers

Contextual identities API grew getSupportedColors() / getSupportedIcons() and renamed a few colors. Combined with the file-access opt-in that already shipped, 153 is a "read the MDN page, don't assume 152" release. I wrote the file-access piece in Firefox is about to make file access opt-in.

Chrome 151's MV2-flag deletion is live in stable as of last Monday. August 31 is still the store funeral.

What I'd do this week

Firefox developers: add build-for-amo, run it in CI, attach the log to the source zip. Don't be the person whose review sits in "waiting for a reproducible build" for two weeks.

Chrome 152: grep for setBadgeText and for browser. usage outside a real extension context. The Chrome 148 browser namespace post is the background; the 152 gate is the punchline.

CWS privacy rules enforced August 1 — if you're reading this on the 3rd, the grace period is already over. @extenshi/cli won't write your privacy policy, but the privacy-policy generator will draft one from the permissions you ship. Five CLI scans/month free; prepaid packs after that.

Sources

• "Firefox 153 WebExtensions API updates", Mozilla Add-ons Blog, 2026-07-23
• WEWG PR #905, privileged / isolated / main world definitions, merged 2026-07-30
• Chrome 152 milestone schedule, early stable 2026-08-12
• Chromium CL 7907524, DNR indexing drops data-decoder process

Methodology

Signals dated 2026-07-27 through 2026-08-03. Chrome 16x schedule docs collapsed to one line. Catalog MAU on Chrome 152 rows is the Chrome listing universe, not a user-breakage claim.

This issue of Extension Pulse is compiled from Mozilla's add-ons blog, WEWG PRs, Chromium Gerrit, and Extenshi catalog snapshots. We don't independently verify every upstream claim. If something here is off, tell us at [email protected].

Last week's Pulse → · Browse the catalog →