Skip to content

Conversation

@selenium-ci
Copy link
Member

@selenium-ci selenium-ci commented Oct 30, 2025

User description

This is an automated pull request to update pinned browsers and drivers

Merge after verify the new browser versions properly passing the tests and no bugs need to be filed


PR Type

Enhancement


Description

  • Update Firefox beta from 145.0b7 to 145.0b8 on Linux and macOS

  • Update Chrome beta from 142.0.7444.59 to 143.0.7499.5 on Linux and macOS

  • Update corresponding ChromeDriver versions to match Chrome beta

  • Update SHA256 checksums for all updated browser and driver artifacts


Diagram Walkthrough

flowchart LR
  A["Firefox 145.0b7"] -->|"Update to 145.0b8"| B["Firefox 145.0b8"]
  C["Chrome 142.0.7444.59"] -->|"Update to 143.0.7499.5"| D["Chrome 143.0.7499.5"]
  E["ChromeDriver 142.0.7444.59"] -->|"Update to 143.0.7499.5"| F["ChromeDriver 143.0.7499.5"]
  B -->|"Update checksums"| G["Updated artifacts"]
  D -->|"Update checksums"| G
  F -->|"Update checksums"| G
Loading

File Walkthrough

Relevant files
Configuration changes
repositories.bzl
Update browser and driver pinned versions                               

common/repositories.bzl

  • Updated Firefox beta version from 145.0b7 to 145.0b8 with new SHA256
    checksums for Linux and macOS
  • Updated Chrome beta version from 142.0.7444.59 to 143.0.7499.5 with
    new SHA256 checksums for Linux and macOS
  • Updated ChromeDriver version from 142.0.7444.59 to 143.0.7499.5 with
    new SHA256 checksums for Linux and macOS
  • All URL references and integrity hashes updated to match new
    browser/driver versions
+12/-12 

@selenium-ci selenium-ci added the B-build Includes scripting, bazel and CI integrations label Oct 30, 2025
@qodo-merge-pro
Copy link
Contributor

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logs: The added lines only update external artifact URLs and checksums without introducing or
affecting any logging of critical actions, so no evidence of audit trail impact is visible
in the diff.

Referred Code
    http_archive(
        name = "linux_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/145.0b8/linux-x86_64/en-US/firefox-145.0b8.tar.xz",
        sha256 = "ba76d14d2349f3e90e54e8dee0c54707e5844511c152fa1536052c31eee04700",
        build_file_content = """
load("@aspect_rules_js//js:defs.bzl", "js_library")
package(default_visibility = ["//visibility:public"])

filegroup(
    name = "files",
    srcs = glob(["**/*"]),
)

exports_files(["firefox/firefox"])

js_library(
    name = "firefox-js",
    data = [":files"],
)
""",
    )


 ... (clipped 271 lines)
Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
No error handling: The new code only changes Bazel repository URLs and checksums without showing handling for
download/verification failures, leaving uncertainty about robustness within this diff.

Referred Code
    http_archive(
        name = "linux_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/145.0b8/linux-x86_64/en-US/firefox-145.0b8.tar.xz",
        sha256 = "ba76d14d2349f3e90e54e8dee0c54707e5844511c152fa1536052c31eee04700",
        build_file_content = """
load("@aspect_rules_js//js:defs.bzl", "js_library")
package(default_visibility = ["//visibility:public"])

filegroup(
    name = "files",
    srcs = glob(["**/*"]),
)

exports_files(["firefox/firefox"])

js_library(
    name = "firefox-js",
    data = [":files"],
)
""",
    )


 ... (clipped 271 lines)
Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
External artifacts: The PR updates external download URLs and checksums; while checksums are provided, the
diff does not show any additional validation, pinning, or integrity enforcement beyond
sha256, requiring human verification.

Referred Code
    http_archive(
        name = "linux_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/145.0b8/linux-x86_64/en-US/firefox-145.0b8.tar.xz",
        sha256 = "ba76d14d2349f3e90e54e8dee0c54707e5844511c152fa1536052c31eee04700",
        build_file_content = """
load("@aspect_rules_js//js:defs.bzl", "js_library")
package(default_visibility = ["//visibility:public"])

filegroup(
    name = "files",
    srcs = glob(["**/*"]),
)

exports_files(["firefox/firefox"])

js_library(
    name = "firefox-js",
    data = [":files"],
)
""",
    )


 ... (clipped 271 lines)
Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-merge-pro
Copy link
Contributor

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Centralize browser versions and checksums

Instead of hardcoding browser versions and checksums in multiple places, define
them as variables or in a dictionary at the top of the file. This centralizes
configuration, making automated updates easier to review and maintain.

Examples:

common/repositories.bzl [51-54]
    http_archive(
        name = "linux_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/145.0b8/linux-x86_64/en-US/firefox-145.0b8.tar.xz",
        sha256 = "ba76d14d2349f3e90e54e8dee0c54707e5844511c152fa1536052c31eee04700",
common/repositories.bzl [278-281]
    http_archive(
        name = "linux_beta_chrome",
        url = "https://storage.googleapis.com/chrome-for-testing-public/143.0.7499.5/linux64/chrome-linux64.zip",
        sha256 = "8bc1350380c0d916ddabbc243227b5fcaaa85152edf1df1ab19db49b8106bc89",

Solution Walkthrough:

Before:

def browser_repositories():
    # ...
    http_archive(
        name = "linux_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/145.0b8/linux-x86_64/en-US/firefox-145.0b8.tar.xz",
        sha256 = "ba76d14d2349f3e90e54e8dee0c54707e5844511c152fa1536052c31eee04700",
        ...
    )
    # ...
    http_archive(
        name = "linux_beta_chrome",
        url = "https://storage.googleapis.com/chrome-for-testing-public/143.0.7499.5/linux64/chrome-linux64.zip",
        sha256 = "8bc1350380c0d916ddabbc243227b5fcaaa85152edf1df1ab19db49b8106bc89",
        ...
    )
    # ...

After:

_VERSIONS = {
    "firefox_beta": "145.0b8",
    "chrome_beta": "143.0.7499.5",
}
_SHA256 = {
    "linux_firefox_beta": "ba76d14d2349f3e90e54e8dee0c54707e5844511c152fa1536052c31eee04700",
    "linux_chrome_beta": "8bc1350380c0d916ddabbc243227b5fcaaa85152edf1df1ab19db49b8106bc89",
    # ... other checksums
}

def browser_repositories():
    # ...
    http_archive(
        name = "linux_beta_firefox",
        url = "https://ftp.mozilla.org/pub/firefox/releases/{v}/linux-x86_64/en-US/firefox-{v}.tar.xz".format(v = _VERSIONS["firefox_beta"]),
        sha256 = _SHA256["linux_firefox_beta"],
        ...
    )
    # ...
Suggestion importance[1-10]: 8

__

Why: This is a strong architectural suggestion that correctly identifies repeated hardcoded values and proposes centralizing them, which would significantly improve maintainability and simplify future automated updates.

Medium
  • More

@navin772 navin772 merged commit 9b24abb into trunk Oct 30, 2025
50 checks passed
@navin772 navin772 deleted the pinned-browser-updates branch October 30, 2025 05:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

B-build Includes scripting, bazel and CI integrations Review effort 2/5

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants