Skip to content

Conversation

selenium-ci
Copy link
Member

@selenium-ci selenium-ci commented Aug 23, 2025

User description

This is an automated pull request to update pinned browsers and drivers

Merge after verify the new browser versions properly passing the tests and no bugs need to be filed


PR Type

Other


Description

  • Update Firefox beta from 143.0b2 to 143.0b3

  • Update Edge driver from 139.0.3405.102 to 139.0.3405.111

  • Update SHA256 checksums for all browser binaries


Diagram Walkthrough

flowchart LR
  A["Firefox 143.0b2"] --> B["Firefox 143.0b3"]
  C["Edge Driver 139.0.3405.102"] --> D["Edge Driver 139.0.3405.111"]
  E["Old SHA256 checksums"] --> F["Updated SHA256 checksums"]
Loading

File Walkthrough

Relevant files
Dependencies
repositories.bzl
Browser version and checksum updates                                         

common/repositories.bzl

  • Updated Firefox beta version from 143.0b2 to 143.0b3 for Linux and
    macOS
  • Updated Edge driver version from 139.0.3405.102 to 139.0.3405.111 for
    Linux and macOS
  • Updated corresponding SHA256 checksums for all updated binaries
+8/-8     

@selenium-ci selenium-ci added the B-build Includes scripting, bazel and CI integrations label Aug 23, 2025
Copy link
Contributor

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 Security concerns

Supply chain integrity:
Changes rely on external download URLs. While SHA256 pins are updated, reviewers should confirm they were sourced from official release pages and match the binaries to mitigate tampering risks.

⚡ Recommended focus areas for review

Integrity Mismatch Risk

Verify the new SHA256 checksums actually match the downloaded artifacts for the updated Firefox beta and EdgeDriver URLs to avoid build failures or supply-chain issues.

        url = "https://ftp.mozilla.org/pub/firefox/releases/143.0b3/linux-x86_64/en-US/firefox-143.0b3.tar.xz",
        sha256 = "ea43085f0a47d14a8c088175b489c8af149f59703aec20e6dd2bbf01e36d36fc",
        build_file_content = """
load("@aspect_rules_js//js:defs.bzl", "js_library")
package(default_visibility = ["//visibility:public"])

filegroup(
    name = "files",
    srcs = glob(["**/*"]),
)

exports_files(["firefox/firefox"])

js_library(
    name = "firefox-js",
    data = [":files"],
)
""",
    )

    dmg_archive(
        name = "mac_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/143.0b3/mac/en-US/Firefox%20143.0b3.dmg",
        sha256 = "0e392fc487de20c31c4fe66e25473f91ce001dd6e56528409720f7b9934f34e0",
        build_file_content = """
Cross-Platform Parity

Ensure Windows or other platform archives (if used elsewhere) are updated to matching versions to prevent version skew across CI jobs.

        name = "linux_edgedriver",
        url = "https://msedgedriver.microsoft.com/139.0.3405.111/edgedriver_linux64.zip",
        sha256 = "76f1c0e35120e37848c174eee1368150b7c2461b8e4907c80bcfc2e61b93c471",
        build_file_content = """
load("@aspect_rules_js//js:defs.bzl", "js_library")
package(default_visibility = ["//visibility:public"])

exports_files(["msedgedriver"])

js_library(
    name = "msedgedriver-js",
    data = ["msedgedriver"],
)
""",
    )

    http_archive(
        name = "mac_edgedriver",
        url = "https://msedgedriver.microsoft.com/139.0.3405.111/edgedriver_mac64.zip",
        sha256 = "c97588078c6f661dd6c66b858f5e21dc9cbcee40420a2b2e839a05803e0e468f",
        build_file_content = """

Copy link
Contributor

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
Possible issue
Ensure stable extraction layout

Pin the archive integrity using strip_prefix or type to ensure the extracted
layout is as expected. If Mozilla changes the top-level directory name, builds
may silently break. Set strip_prefix to the known folder name within the tarball
for this version.

common/repositories.bzl [51-57]

 http_archive(
     name = "linux_beta_firefox",
     url = "https://ftp.mozilla.org/pub/firefox/releases/143.0b3/linux-x86_64/en-US/firefox-143.0b3.tar.xz",
     sha256 = "ea43085f0a47d14a8c088175b489c8af149f59703aec20e6dd2bbf01e36d36fc",
+    strip_prefix = "firefox",
     build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")
 package(default_visibility = ["//visibility:public"])
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: This is a good suggestion for improving build robustness by using strip_prefix to handle potential changes in the archive's directory structure.

Low
General
Validate DMG contents

Add a fail_fast or executable/app_path parameter (if supported by your
dmg_archive macro) to validate the expected .app bundle exists after mount. This
prevents silent success when the DMG content layout changes.

common/repositories.bzl [73-79]

 dmg_archive(
     name = "mac_beta_firefox",
     url = "https://ftp.mozilla.org/pub/firefox/releases/143.0b3/mac/en-US/Firefox%20143.0b3.dmg",
     sha256 = "0e392fc487de20c31c4fe66e25473f91ce001dd6e56528409720f7b9934f34e0",
+    app_path = "Firefox.app",
     build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")
 package(default_visibility = ["//visibility:public"])
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: This suggestion correctly proposes adding app_path to the dmg_archive rule, which improves build reliability by verifying the DMG contents.

Low
  • More

@navin772 navin772 merged commit f8c356f into trunk Aug 23, 2025
36 checks passed
@navin772 navin772 deleted the pinned-browser-updates branch August 23, 2025 02:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
B-build Includes scripting, bazel and CI integrations Possible security concern Review effort 2/5
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants