8000 Update chromium to 153.0.8010.12 (security update) by bryan-minimal · Pull Request #678 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update chromium to 153.0.8010.12 (security update) - #678

Merged
bryan-minimal merged 3 commits into
mainfrom
update-chromium-153.0.8010.12
Sep 14, 2026
Merged

Update chromium to 153.0.8010.12 (security update)#678
bryan-minimal merged 3 commits into
mainfrom
update-chromium-153.0.8010.12

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Sep 3, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Member

Updates chromium-bin + chromium-headless-shell-bin from 152.0.7977.8 to 153.0.8010.12 — a Chromium security update (each Chrome major carries Critical fixes).

Channel context (#646): chromium-bin tracks Playwright's pin, which is pre-stable by design; 153.0.8010.12 is ahead of current Linux stable (152.0.7977.75). CVEs publish only against stable, so a 0/0/0 scan for this package means "ahead of the published feed", not "audited clean".

chromium pins three interlocked identifiers, resolved from three sources:

identifier value source
browser_version 153.0.8010.12 Playwright browsers.json
revision 1243 Playwright browsers.json (arm64 legs are Playwright-gated)
snapshot_position 1681086 chromiumdash branch position → nearest available amd64 snapshot

Four artifacts fetched + sha256'd fresh (amd64 chrome-linux.zip + headless-shell.zip from the snapshot bucket; arm64 chromium / headless-shell builds at the Playwright revision). Resolved + rewritten by pkgmgr (gominimal/pkgmgr-rs#515).

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Updates
    • Updated the bundled Chromium and headless-shell versions to Chrome 153.0.8010.12.
    • Refreshed platform-specific packages for improved compatibility across amd64 and arm64 systems.

@coderabbitai
coderabbitai Bot commented Sep 3, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 599a4c9b-7f77-4b3c-b7ab-a0b65b1bb911

📥 Commits

Reviewing files that changed from the base of the PR and between 2c77583 and 8e0cfc3.

📒 Files selected for processing (2)
  • packages/chromium-bin/build.ncl
  • packages/chromium-headless-shell-bin/build.ncl

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📝 Walkthrough

Walkthrough

The Chromium binary and headless-shell package definitions update to Playwright revision 1243, Chrome 153.0.8010.12, snapshot 1681086, and matching amd64 and arm64 archive checksums.

Changes

Chromium package pins

Layer / File(s) Summary
Chromium binary pin and checksums
packages/chromium-bin/build.ncl		 Updates the Chromium revision, browser version, snapshot position, and amd64 and arm64 archive checksums.
Headless-shell pin and checksums
packages/chromium-headless-shell-bin/build.ncl		 Updates the headless-shell revision, browser version, snapshot position, and snapshot, full-browser, and resource archive checksums.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to ad500

This updates Chromium and headless-shell binary pins and checksums to Chromium 153.0.8010.12. The package updates are internally consistent, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely identifies the main change: updating Chromium to version 153.0.8010.12 as a security update.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch update-chromium-153.0.8010.12

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal
no-op: re-run after clearing a poisoned download cache entry
6f665d7 
The amd64 failure was NOT this bump. res-server-amd64 had cached a TRUNCATED
chrome-linux.zip under the expected-sha directory:

  cached:   168,943,616 bytes, sha256 26f4c4305deb25e9...
  real:     244,832,780 bytes, sha256 4cd65eb42af4eb79...  (== the pin here)

The truncated file kept its valid PK\003\004 header, so unzip failed on the
missing central directory rather than reporting a bad file. The pin in this PR
is correct — verified by downloading the artifact and hashing it.

Cache entry removed; arm64's object hashed correctly and was left alone.
@bryan-minimal
no-op: retry the amd64 fetch
ad500f6 
Attempts so far got 168,943,616 then 229,105,288 bytes of a 244,832,780-byte
artifact — progressively further, which looks like a fetch timeout rather than
corruption. Retrying to see whether it completes.
@bryan-minimal
bryan-minimal added this pull request to the merge queue Sep 14, 2026
Merged via the queue into main with commit 18b2cfb Sep 14, 2026
10 checks passed
@bryan-minimal
bryan-minimal deleted the update-chromium-153.0.8010.12 branch September 14, 2026 19:46
@bryan-minimal bryan-minimal mentioned this pull request Sep 18, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mitodrummer mitodrummer mitodrummer approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bryan-minimal @mitodrummer
0