/"
+ type = "benchmark"
+ unit = "score"
+ support_class = "jetstream3.py"
+ repository = "https://github.com/webkit/jetstream"
++# Keep this in sync with the version used in PGO instrumentation by updating
++# `taskcluster/kinds/fetch/benchmarks.yml`.
+ repository_revision = "a3f5c45465f5271bed385321a0587bd4202682d6"
+ test_script = "jetstream3.js"
+
+ ["jetstream3"]
+ suite_name = "JetStream3.0"
+
diff --git a/src/external-patches/firefox/ff150_2_pgo_patch_for_bug-2011620.patch b/src/external-patches/firefox/ff150_2_pgo_patch_for_bug-2011620.patch
new file mode 100644
index 000000000..da9579a02
--- /dev/null
+++ b/src/external-patches/firefox/ff150_2_pgo_patch_for_bug-2011620.patch
@@ -0,0 +1,409 @@
+diff --git a/build/pgo/index.html b/build/pgo/index.html
+--- a/build/pgo/index.html
++++ b/build/pgo/index.html
+@@ -10,10 +10,11 @@
+ "blueprint/forms.html",
+ "blueprint/grid.html",
+ "blueprint/sample.html",
+ "js-input/3d-thingy.html",
+ "js-input/crypto-otp.html",
++ "js-input/normalizer_bench.html",
+ "js-input/sunspider/3d-cube.html",
+ "js-input/sunspider/3d-morph.html",
+ "js-input/sunspider/3d-raytrace.html",
+ "js-input/sunspider/access-binary-trees.html",
+ "js-input/sunspider/access-fannkuch.html",
+diff --git a/build/pgo/js-input/normalizer_bench.html b/build/pgo/js-input/normalizer_bench.html
+new file mode 100644
+--- /dev/null
++++ b/build/pgo/js-input/normalizer_bench.html
+@@ -0,0 +1,358 @@
++
++
++
++
++Normalizer bench
++
++Normalizer Bench
++
++ - S
++ - Short: NFD fits in 32 UTF-16 code units. French and German are adjusted to take a substring that contains a non-ASCII character. (Long input contains the same information in each language instead of having a fixed UTF-16 length.)
++ - L
++ - Latin1.
++ - U
++ - Forced UTF-16 form for Latin1 languages. (One non-Latin1 character added to the string.)
++ - W
++ - Forced write: In the UTF-16 case, a singleton is prepended to force the normalizer to start writing from the start. In the Latin1 case, a character with a compatibility decomposition is prepended, since there are no singletons in Latin1. This means the effect is seen only in the K forms.
++ - C
++ - Forced copy: In the UTF-16 case, a singleton is appended to force the normalizer to make a copy even when normalizing from NFC to a C form or from NFD to a D form. In the Latin1 case, a character with a compatibility decomposition is appended, since there are no singletons in Latin1. This means the effect is seen only in the K form corresponding to the input C or D form.
++
++
++Bench not started.
++
++
++| Input | NFC | NFKC | NFD | NFKD |
|---|
++| Bench not run. |
++
++
++
++
+diff --git a/testing/mozharness/scripts/android_emulator_pgo.py b/testing/mozharness/scripts/android_emulator_pgo.py
+--- a/testing/mozharness/scripts/android_emulator_pgo.py
++++ b/testing/mozharness/scripts/android_emulator_pgo.py
+@@ -28,10 +28,11 @@
+ "blueprint/forms.html",
+ "blueprint/grid.html",
+ "blueprint/elements.html",
+ "js-input/3d-thingy.html",
+ "js-input/crypto-otp.html",
++ "js-input/normalizer_bench.html",
+ "js-input/sunspider/3d-cube.html",
+ "js-input/sunspider/3d-morph.html",
+ "js-input/sunspider/3d-raytrace.html",
+ "js-input/sunspider/access-binary-trees.html",
+ "js-input/sunspider/access-fannkuch.html",
+diff --git a/toolkit/content/license.html b/toolkit/content/license.html
+--- a/toolkit/content/license.html
++++ b/toolkit/content/license.html
+@@ -5786,10 +5786,11 @@
+ third_party/rust/yoke-derive
+ third_party/rust/zerofrom
+ third_party/rust/zerofrom-derive
+ third_party/rust/zerovec
+ third_party/rust/zerovec-derive
++ build/pgo/js-input/normalizer_bench.html
+
+
+
+
+ UNICODE LICENSE V3
+
diff --git a/src/external-patches/firefox/ff150_3_pgo_patch_for_bug-2014422.patch b/src/external-patches/firefox/ff150_3_pgo_patch_for_bug-2014422.patch
new file mode 100644
index 000000000..99add604c
--- /dev/null
+++ b/src/external-patches/firefox/ff150_3_pgo_patch_for_bug-2014422.patch
@@ -0,0 +1,868 @@
+diff --git a/build/pgo/index.html b/build/pgo/index.html
+--- a/build/pgo/index.html
++++ b/build/pgo/index.html
+@@ -49,10 +49,11 @@
+ "blueprint/forms.html",
+ "blueprint/grid.html",
+ "blueprint/sample.html",
+ "js-input/3d-thingy.html",
+ "js-input/crypto-otp.html",
++ "js-input/collator_bench.html",
+ "js-input/normalizer_bench.html",
+ "js-input/sunspider/3d-cube.html",
+ "js-input/sunspider/3d-morph.html",
+ "js-input/sunspider/3d-raytrace.html",
+ "js-input/sunspider/access-binary-trees.html",
+diff --git a/build/pgo/js-input/collator_bench.html b/build/pgo/js-input/collator_bench.html
+new file mode 100644
+--- /dev/null
++++ b/build/pgo/js-input/collator_bench.html
+@@ -0,0 +1,817 @@
++
++
++
++
++Collator bench
++
++Collator Bench
++
++Bench not started.
++
++
++| Workload | Time |
|---|
++| Bench not run. |
++
++
++
++
++
+diff --git a/testing/mozharness/scripts/android_emulator_pgo.py b/testing/mozharness/scripts/android_emulator_pgo.py
+--- a/testing/mozharness/scripts/android_emulator_pgo.py
++++ b/testing/mozharness/scripts/android_emulator_pgo.py
+@@ -29,10 +29,11 @@
+ "blueprint/forms.html",
+ "blueprint/grid.html",
+ "blueprint/elements.html",
+ "js-input/3d-thingy.html",
+ "js-input/crypto-otp.html",
++ "js-input/collator_bench.html",
+ "js-input/normalizer_bench.html",
+ "js-input/sunspider/3d-cube.html",
+ "js-input/sunspider/3d-morph.html",
+ "js-input/sunspider/3d-raytrace.html",
+ "js-input/sunspider/access-binary-trees.html",
+diff --git a/toolkit/content/license.html b/toolkit/content/license.html
+--- a/toolkit/content/license.html
++++ b/toolkit/content/license.html
+@@ -5788,10 +5788,11 @@
+ third_party/rust/zerofrom
+ third_party/rust/zerofrom-derive
+ third_party/rust/zerovec
+ third_party/rust/zerovec-derive
+ build/pgo/js-input/normalizer_bench.html
++ build/pgo/js-input/collator_bench.html
+
+ |
+
+
+ UNICODE LICENSE V3
+
diff --git a/src/external-patches/manifest.json b/src/external-patches/manifest.json
index 91c2934ab..ff81da911 100644
--- a/src/external-patches/manifest.json
+++ b/src/external-patches/manifest.json
@@ -40,5 +40,20 @@
"type": "phabricator",
"id": "D291714",
"name": "gh-12979 Clip dirty_rect to device_size"
+ },
+ {
+ "type": "phabricator",
+ "id": "D256645",
+ "name": "FF150 1 PGO patch for bug-1962418"
+ },
+ {
+ "type": "phabricator",
+ "id": "D279829",
+ "name": "FF150 2 PGO patch for bug-2011620"
+ },
+ {
+ "type": "phabricator",
+ "id": "D281762",
+ "name": "FF150 3 PGO patch for bug-2014422"
}
]
diff --git a/src/zen/common/sys/ZenActorsManager.sys.mjs b/src/zen/common/sys/ZenActorsManager.sys.mjs
index 6595d55ee..3f1404557 100644
--- a/src/zen/common/sys/ZenActorsManager.sys.mjs
+++ b/src/zen/common/sys/ZenActorsManager.sys.mjs
@@ -54,7 +54,7 @@ let JSWINDOWACTORS = {
},
},
allFrames: true,
- matches: ["*://*/*"],
+ remoteTypes: ["web", "file"],
enablePreference: "zen.glance.enabled",
},
};
From 4add28d3c026d1f2d30dfe8bed1d22f660491f44 Mon Sep 17 00:00:00 2001
From: CosmoCreeper <179134799+CosmoCreeper@users.noreply.github.com>
Date: Thu, 9 Apr 2026 16:46:47 -0400
Subject: [PATCH 65/70] no-bug: Remove non-existent hooks property (gh-13160)
Co-authored-by: mr. m <91018726+mr-cheffy@users.noreply.github.com>
---
package.json | 4 ----
1 file changed, 4 deletions(-)
diff --git a/package.json b/package.json
index a9d156ad1..f5dff7d7a 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,6 @@
"sync:l10n": "python3 scripts/update_ff.py --just-l10n",
"lint": "cd engine && ./mach lint zen",
"lint:fix": "npm run lint -- --fix",
- "prepare": "husky",
"reset-ff": "surfer reset",
"surfer": "surfer",
"test": "python3 scripts/run_tests.py",
@@ -38,9 +37,6 @@
"type": "git",
"url": "git+https://github.com/zen-browser/desktop.git"
},
- "hooks": {
- "pre-commit": "npm run prepare"
- },
"keywords": [],
"author": "",
"license": "MPL-2.0",
From dfc47ee5d746e9f0e77544ccc65edcf5ff5382df Mon Sep 17 00:00:00 2001
From: DQSS
Date: Thu, 9 Apr 2026 22:51:24 +0200
Subject: [PATCH 66/70] gh-12241: fix skip startup bookmark invalidation when
no workspace bookmarks exist (gh-13168)
---
src/zen/spaces/ZenSpaceManager.mjs | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/zen/spaces/ZenSpaceManager.mjs b/src/zen/spaces/ZenSpaceManager.mjs
index d1f6a609d..53dcf5bed 100644
--- a/src/zen/spaces/ZenSpaceManager.mjs
+++ b/src/zen/spaces/ZenSpaceManager.mjs
@@ -2469,8 +2469,14 @@ class nsZenWorkspaces {
}
}
- // Reset bookmarks
- this.#invalidateBookmarkContainers();
+ // Avoid forcing a startup toolbar rebuild when there are no
+ // workspace-specific bookmark assignments to apply.
+ const hasWorkspaceBookmarks = !!Object.keys(
+ this._workspaceBookmarksCache?.bookmarks || {}
+ ).length;
+ if (!onInit || hasWorkspaceBookmarks) {
+ this.#invalidateBookmarkContainers();
+ }
// Update workspace indicator
await this.updateWorkspaceIndicator(workspace, this.workspaceIndicator);
From 000098adb1a8af279c274e3f00cbc71a7ecc4b04 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 9 Apr 2026 23:40:53 +0200
Subject: [PATCH 67/70] no-bug: bump axios from 1.13.6 to 1.15.0 in the
npm_and_yarn group across 1 directory (gh-13187)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the npm_and_yarn group with 1 update in the / directory:
[axios](https://github.com/axios/axios).
Updates `axios` from 1.13.6 to 1.15.0
Release notes
Sourced from axios's
releases.
v1.15.0
This release delivers two critical security patches, adds runtime
support for Deno and Bun, and includes significant CI hardening,
documentation improvements, and routine dependency updates.
⚠️ Important Changes
- Deprecation:
url.parse() usage has
been replaced to address Node.js deprecation warnings. If you are on a
recent version of Node.js, this resolves console warnings you may have
been seeing. (#10625)
🔒 Security Fixes
- Proxy Handling: Fixed a
no_proxy
hostname normalisation bypass that could lead to Server-Side Request
Forgery (SSRF). (#10661)
- Header Injection: Fixed an unrestricted cloud
metadata exfiltration vulnerability via a header injection chain.
(#10660)
🚀 New Features
- Runtime Support: Added compatibility checks and
documentation for Deno and Bun environments. (#10652,
#10653)
🔧 Maintenance & Chores
- CI Security: Hardened workflow permissions to least
privilege, added the
zizmor security scanner, pinned action
versions, and gated npm publishing with OIDC and environment protection.
(#10618,
#10619,
#10627,
#10637,
#10666)
- Dependencies: Bumped
serialize-javascript, handlebars,
picomatch, vite, and
denoland/setup-deno to latest versions. Added a 7-day
Dependabot cooldown period. (#10574,
#10572,
#10568,
#10663,
#10664,
#10665,
#10669,
#10670,
#10616)
- Documentation: Unified docs, improved
beforeRedirect credential leakage example, clarified
withCredentials/withXSRFToken behaviour,
HTTP/2 support notes, async/await timeout error handling, header case
preservation, and various typo fixes. (#10649,
#10624,
#7452,
#7471,
#10654,
#10644,
#10589)
- Housekeeping: Removed stale files, regenerated
lockfile, and updated sponsor scripts and blocks. (#10584,
#10650,
#10582,
#10640,
#10659,
#10668)
- Tests: Added regression coverage for urlencoded
Content-Type casing. (#10573)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for
helping improve Axios:
v1.14.0
This release focuses on compatibility fixes, adapter stability
improvements, and test/tooling modernisation.
⚠️ Important Changes
- Breaking Changes: None identified in this
release.
- Action Required: If you rely on env-based proxy
behaviour or CJS resolution edge-cases, validate your integration after
upgrade (notably
proxy-from-env v2 alignment and
main entry compatibility fix).
🚀 New Features
- Runtime Features: No new end-user features were
introduced in this release.
- Test Coverage Expansion: Added broader smoke/module
test coverage for CJS and ESM package usage. (#7510)
🐛 Bug Fixes
- Headers: Trim trailing CRLF in normalised header
values. (#7456)
- HTTP/2: Close detached HTTP/2 sessions on timeout
to avoid lingering sessions. (#7457)
- Fetch Adapter: Cancel
ReadableStream
created during request-stream capability probing to prevent async
resource leaks. (#7515)
- Proxy Handling: Fixed env proxy behavior with
proxy-from-env v2 usage. (#7499)
... (truncated)
Changelog
Sourced from axios's
changelog.
Changelog
1.13.3
(2026-01-20)
Bug Fixes
- http2: Use port 443 for HTTPS connections by
default. (#7256)
(d7e6065)
- interceptor: handle the error in the same
interceptor (#6269)
(5945e40)
- main field in package.json should correspond to cjs artifacts (#5756)
(7373fbf)
- package.json: add 'bun' package.json 'exports'
condition. Load the Node.js build in Bun instead of the browser build
(#5754)
(b89217e)
- silentJSONParsing=false should throw on invalid JSON (#7253)
(#7257)
(7d19335)
- turn AxiosError into a native error (#5394)
(#5558)
(1c6a86d)
- types: add handlers to AxiosInterceptorManager
interface (#5551)
(8d1271b)
- types: restore AxiosError.cause type from unknown
to Error (#7327)
(d8233d9)
- unclear error message is thrown when specifying an empty proxy
authorization (#6314)
(6ef867e)
Features
Reverts
- Revert "fix: silentJSONParsing=false should throw on invalid
JSON (#7253)
(#7…"
(#7298)
(a4230f5),
closes #7253 #7 #7298
- deps: bump peter-evans/create-pull-request from 7
to 8 in the github-actions group (#7334)
(2d6ad5e)
Contributors to this release
... (truncated)
Commits
772a4e5
chore(release): prepare release 1.15.0 (#10671)4b07137
chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (#10663)51e57b3
chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (#10664)fba1a77
chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (#10665)0bf6e28
chore(deps): bump denoland/setup-deno in the github-actions group (#10669)8107157
chore(deps-dev): bump the development_dependencies group with 4 updates
(#10670)e66530e
ci: require npm-publish environment for releases (#10666)49f23cb
chore(sponsor): update sponsor block (#10668)3631854
fix: unrestricted cloud metadata exfiltration via header injection chain
(#10...fb3befb
fix: no_proxy hostname normalization bypass leads to ssrf (#10661)- Additional commits viewable in compare
view
Install script changes
This version modifies prepare script that runs during
installation. Review the package contents before updating.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/zen-browser/desktop/network/alerts).
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
package-lock.json | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 65a139677..c773998a9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1005,15 +1005,15 @@
"license": "MIT"
},
"node_modules/axios": {
- "version": "1.13.6",
- "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz",
- "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==",
+ "version": "1.15.0",
+ "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
+ "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
"dev": true,
"license": "MIT",
"dependencies": {
"follow-redirects": "^1.15.11",
"form-data": "^4.0.5",
- "proxy-from-env": "^1.1.0"
+ "proxy-from-env": "^2.1.0"
}
},
"node_modules/b4a": {
@@ -3254,11 +3254,14 @@
}
},
"node_modules/proxy-from-env": {
- "version": "1.1.0",
- "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
- "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+ "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
"dev": true,
- "license": "MIT"
+ "license": "MIT",
+ "engines": {
+ "node": ">=10"
+ }
},
"node_modules/pump": {
"version": "3.0.2",
From 11cf410f873c22e9680f21c8a7437b565d6ef427 Mon Sep 17 00:00:00 2001
From: JDX50S <71799746+smoke-wolf@users.noreply.github.com>
Date: Fri, 10 Apr 2026 07:25:16 -0300
Subject: [PATCH 68/70] no-bug: fix SIGNMAR path in Sign MAR step to point at
binary not directory (gh-13193)
---
.github/workflows/build.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 07203a4a6..92ca489cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -512,7 +512,7 @@ jobs:
- name: Sign MAR files
env:
- SIGNMAR: ${{ github.workspace }}/signmar-linux-x86_64
+ SIGNMAR: ${{ github.workspace }}/signmar-linux-x86_64/signmar
ZEN_MAR_SIGNING_PASSWORD: ${{ secrets.ZEN_MAR_SIGNING_PASSWORD }}
ZEN_SIGNING_CERT_PEM_BASE64: ${{ secrets.ZEN_SIGNING_CERT_PEM_BASE64 }}
ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64: ${{ secrets.ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64 }}
From 97451e23c82eee85e614a1eaa274799e3cdababd Mon Sep 17 00:00:00 2001
From: "mr. m" <91018726+mr-cheffy@users.noreply.github.com>
Date: Fri, 10 Apr 2026 17:17:52 +0200
Subject: [PATCH 69/70] no-bug: Individually download each artifact on release
(gh-13199)
---
.github/workflows/build.yml | 33 ++++++++++++++++++++++++++++-----
package-lock.json | 11 +++++++----
scripts/mar_sign.sh | 2 ++
3 files changed, 37 insertions(+), 9 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 92ca489cd..e9218085c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -490,8 +490,35 @@ jobs:
submodules: recursive
token: ${{ secrets.DEPLOY_KEY }}
- - name: Download artifact
+ - name: Download artifact (source)
uses: actions/download-artifact@v4
+ with:
+ name: zen.source.tar.zst
+
+ - name: Download artifact (MAR files)
+ uses: actions/download-artifact@v4
+ with:
+ pattern: "*.mar"
+
+ - name: Download artifact (Linux tars)
+ uses: actions/download-artifact@v4
+ with:
+ pattern: "zen.linux-*.tar.xz"
+
+ - name: Download artifact (Linux AppImage)
+ uses: actions/download-artifact@v4
+ with:
+ pattern: "zen-*.AppImage*"
+
+ - name: Download artifact (macOS universal DMG)
+ uses: actions/download-artifact@v4
+ with:
+ name: zen.macos-universal.dmg
+
+ - name: Download artifact (Windows installers)
+ uses: actions/download-artifact@v4
+ with:
+ pattern: "zen.installer*.exe"
- name: Checkout updates repository
uses: actions/checkout@v4
@@ -565,8 +592,6 @@ jobs:
./zen-x86_64.AppImage.zsync/*
./zen-aarch64.AppImage/*
./zen-aarch64.AppImage.zsync/*
- ./zen.win-x86_64.zip/*
- ./zen.win-arm64.zip/*
./linux.mar/*
./linux-aarch64.mar/*
./windows.mar/*
@@ -604,8 +629,6 @@ jobs:
./zen-x86_64.AppImage.zsync/*
./zen-aarch64.AppImage/*
./zen-aarch64.AppImage.zsync/*
- ./.github/workflows/object/windows-x64-signed-x86_64/zen.win-x86_64.zip
- ./.github/workflows/object/windows-x64-signed-arm64/zen.win-arm64.zip
./linux.mar/*
./linux-aarch64.mar/*
./.github/workflows/object/windows-x64-signed-x86_64/windows.mar
diff --git a/package-lock.json b/package-lock.json
index c773998a9..fa57400cb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4177,16 +4177,19 @@
"peer": true
},
"node_modules/yaml": {
- "version": "2.7.0",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.0.tgz",
- "integrity": "sha512-+hSoy/QHluxmC9kCIJyL/uyFmLmc+e5CFR5Wa+bpIhIj85LVb9ZH2nVnqrHoSvKogwODv0ClqZkmiSSaIH5LTA==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true,
"license": "ISC",
"bin": {
"yaml": "bin.mjs"
},
"engines": {
- "node": ">= 14"
+ "node": ">= 14.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/eemeli"
}
},
"node_modules/zip": {
diff --git a/scripts/mar_sign.sh b/scripts/mar_sign.sh
index 2dfbfbc6c..8b12a5d68 100644
--- a/scripts/mar_sign.sh
+++ b/scripts/mar_sign.sh
@@ -111,6 +111,8 @@ sign_mars() {
exit 1
fi
+ chmod +x "$SIGNMAR"
+
create_nss_config_dir
folders=(
From fd8308fcb12631f1c498d7cb9e0351263acd799b Mon Sep 17 00:00:00 2001
From: "mr. m" <91018726+mr-cheffy@users.noreply.github.com>
Date: Sat, 11 Apr 2026 12:03:04 +0200
Subject: [PATCH 70/70] Revert "no-bug: Individually download each artifact on
release" (gh-13211)
Reverts zen-browser/desktop#13199
---------
Signed-off-by: mr. m <91018726+mr-cheffy@users.noreply.github.com>
---
.github/workflows/build.yml | 29 +----------------------------
package-lock.json | 11 ++++-------
2 files changed, 5 insertions(+), 35 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e9218085c..00e8d76f1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -490,35 +490,8 @@ jobs:
submodules: recursive
token: ${{ secrets.DEPLOY_KEY }}
- - name: Download artifact (source)
+ - name: Download artifact
uses: actions/download-artifact@v4
- with:
- name: zen.source.tar.zst
-
- - name: Download artifact (MAR files)
- uses: actions/download-artifact@v4
- with:
- pattern: "*.mar"
-
- - name: Download artifact (Linux tars)
- uses: actions/download-artifact@v4
- with:
- pattern: "zen.linux-*.tar.xz"
-
- - name: Download artifact (Linux AppImage)
- uses: actions/download-artifact@v4
- with:
- pattern: "zen-*.AppImage*"
-
- - name: Download artifact (macOS universal DMG)
- uses: actions/download-artifact@v4
- with:
- name: zen.macos-universal.dmg
-
- - name: Download artifact (Windows installers)
- uses: actions/download-artifact@v4
- with:
- pattern: "zen.installer*.exe"
- name: Checkout updates repository
uses: actions/checkout@v4
diff --git a/package-lock.json b/package-lock.json
index fa57400cb..c773998a9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4177,19 +4177,16 @@
"peer": true
},
"node_modules/yaml": {
- "version": "2.8.3",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
- "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+ "version": "2.7.0",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.0.tgz",
+ "integrity": "sha512-+hSoy/QHluxmC9kCIJyL/uyFmLmc+e5CFR5Wa+bpIhIj85LVb9ZH2nVnqrHoSvKogwODv0ClqZkmiSSaIH5LTA==",
"dev": true,
"license": "ISC",
"bin": {
"yaml": "bin.mjs"
},
"engines": {
- "node": ">= 14.6"
- },
- "funding": {
- "url": "https://github.com/sponsors/eemeli"
+ "node": ">= 14"
}
},
"node_modules/zip": {
|