Adding upstream version 127.0.1.upstream/127.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

50 files changed, 1089 insertions, 772 deletions

diff --git a/browser/branding/aurora/branding.nsi b/browser/branding/aurora/branding.nsi
index f3c573733e..682fa9fda5 100644
--- a/browser/branding/aurora/branding.nsi
+++ b/browser/branding/aurora/branding.nsi
@@ -24,7 +24,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "DigiCert SHA2 Assured ID Code Signing CA"
+!define CertIssuerDownload "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings.
diff --git a/browser/branding/nightly/branding.nsi b/browser/branding/nightly/branding.nsi
index b37853b776..636d2f7824 100644
--- a/browser/branding/nightly/branding.nsi
+++ b/browser/branding/nightly/branding.nsi
@@ -23,7 +23,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "DigiCert SHA2 Assured ID Code Signing CA"
+!define CertIssuerDownload "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings.
diff --git a/browser/branding/official/branding.nsi b/browser/branding/official/branding.nsi
index bbdead7e4a..94ffbaa98f 100644
--- a/browser/branding/official/branding.nsi
+++ b/browser/branding/official/branding.nsi
@@ -28,7 +28,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "DigiCert SHA2 Assured ID Code Signing CA"
+!define CertIssuerDownload "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings. These are tweaked to look good with the en-US strings; ideally
diff --git a/browser/branding/unofficial/branding.nsi b/browser/branding/unofficial/branding.nsi
index 1fc5c12d2a..4c52c1d0c0 100644
--- a/browser/branding/unofficial/branding.nsi
+++ b/browser/branding/unofficial/branding.nsi
@@ -23,7 +23,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "DigiCert SHA2 Assured ID Code Signing CA"
+!define CertIssuerDownload "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings.
diff --git a/browser/components/BrowserGlue.sys.mjs b/browser/components/BrowserGlue.sys.mjs
index b6ae665df0..81889db040 100644
--- a/browser/components/BrowserGlue.sys.mjs
+++ b/browser/components/BrowserGlue.sys.mjs
@@ -4474,7 +4474,21 @@ BrowserGlue.prototype = {
       // This is achieved by converting them into a string pref and encrypting the values
       // stored inside it.
 
-      if (!AppConstants.NIGHTLY_BUILD) {
+      // Note: we don't run this on nightly builds and we also do not run this
+      // for users with primary password enabled. That means both these sets of
+      // users will have the features turned on by default. For Nightly this is
+      // an intentional product decision; for primary password this is because
+      // we cannot encrypt the opt-out value without asking for the primary
+      // password, which in turn means we cannot migrate without doing so. It
+      // is also very difficult to postpone this migration because there is no
+      // way to know when the user has put in the primary password. We will
+      // probably reconsider some of this architecture in future, but for now
+      // this is the least-painful method considering the alternatives, cf.
+      // bug 1901899.
+      if (
+        !AppConstants.NIGHTLY_BUILD &&
+        !lazy.LoginHelper.isPrimaryPasswordSet()
+      ) {
         const hasRunBetaMigration = Services.prefs
           .getCharPref("browser.startup.homepage_override.mstone", "")
           .startsWith("127.0");
diff --git a/browser/components/shopping/ShoppingSidebarChild.sys.mjs b/browser/components/shopping/ShoppingSidebarChild.sys.mjs
index ff80086d5d..1ffeb914e3 100644
--- a/browser/components/shopping/ShoppingSidebarChild.sys.mjs
+++ b/browser/components/shopping/ShoppingSidebarChild.sys.mjs
@@ -85,6 +85,9 @@ export class ShoppingSidebarChild extends RemotePageChild {
   #product = null;
 
   receiveMessage(message) {
+    if (this.browsingContext.usePrivateBrowsing) {
+      throw new Error("We should never be invoked in PBM.");
+    }
     switch (message.name) {
       case "ShoppingSidebar:UpdateProductURL":
         let { url, isReload } = message.data;
diff --git a/browser/components/shopping/ShoppingSidebarParent.sys.mjs b/browser/components/shopping/ShoppingSidebarParent.sys.mjs
index a7733c9a28..e0208a818d 100644
--- a/browser/components/shopping/ShoppingSidebarParent.sys.mjs
+++ b/browser/components/shopping/ShoppingSidebarParent.sys.mjs
@@ -43,6 +43,9 @@ export class ShoppingSidebarParent extends JSWindowActorParent {
   }
 
   async receiveMessage(message) {
+    if (this.browsingContext.usePrivateBrowsing) {
+      throw new Error("We should never be invoked in PBM.");
+    }
     switch (message.name) {
       case "GetProductURL":
         let sidebarBrowser = this.browsingContext.top.embedderElement;
@@ -168,6 +171,12 @@ class ShoppingSidebarManagerClass {
   #initialized = false;
   #everyWindowCallbackId = `shopping-${Services.uuid.generateUUID()}`;
 
+  // Public API methods - these check that we are not in private browsing
+  // mode. (It might be nice to eventually shift pref checks to the public
+  // API, too.)
+  //
+  // Note that any refactoring should preserve the PBM checks in public APIs.
+
   ensureInitialized() {
     if (this.#initialized) {
       return;
@@ -220,6 +229,10 @@ class ShoppingSidebarManagerClass {
     this.enabled = lazy.NimbusFeatures.shopping2023.getVariable("enabled");
 
     for (let window of lazy.BrowserWindowTracker.orderedWindows) {
+      let isPBM = lazy.PrivateBrowsingUtils.isWindowPrivate(window);
+      if (isPBM) {
+        continue;
+      }
       this.updateSidebarVisibilityForWindow(window);
     }
   }
@@ -233,6 +246,11 @@ class ShoppingSidebarManagerClass {
       return;
     }
 
+    let isPBM = lazy.PrivateBrowsingUtils.isWindowPrivate(window);
+    if (isPBM) {
+      return;
+    }
+
     let document = window.document;
 
     if (!this.isActive) {
@@ -254,6 +272,54 @@ class ShoppingSidebarManagerClass {
     this._maybeToggleSidebar(selectedBrowser, currentURI, 0, false);
   }
 
+  /**
+   * Called by TabsProgressListener whenever any browser navigates from one
+   * URL to another.
+   * Note that this includes hash changes / pushState navigations, because
+   * those can be significant for us.
+   */
+  onLocationChange(aBrowser, aLocationURI, aFlags) {
+    let isPBM = lazy.PrivateBrowsingUtils.isWindowPrivate(aBrowser.ownerGlobal);
+    if (isPBM) {
+      return;
+    }
+
+    lazy.ShoppingUtils.onLocationChange(aLocationURI, aFlags);
+
+    this._maybeToggleButton(aBrowser.getTabBrowser());
+    this._maybeToggleSidebar(aBrowser, aLocationURI, aFlags, true);
+  }
+
+  handleEvent(event) {
+    switch (event.type) {
+      case "TabSelect": {
+        if (!this.enabled) {
+          return;
+        }
+        this.updateSidebarVisibility();
+        if (event.detail?.previousTab.linkedBrowser) {
+          this._updateBCActiveness(event.detail.previousTab.linkedBrowser);
+        }
+        break;
+      }
+      case "visibilitychange": {
+        if (!this.enabled) {
+          return;
+        }
+        let { gBrowser } = event.target.ownerGlobal.top;
+        if (!gBrowser) {
+          return;
+        }
+        this.updateSidebarVisibilityForWindow(event.target.ownerGlobal.top);
+        this._updateBCActiveness(gBrowser.selectedBrowser);
+      }
+    }
+  }
+
+  // Private API methods - these assume we are not in private browsing
+  // mode. (It might be nice to eventually shift pref checks to the public
+  // API, too.)
+
   _maybeToggleSidebar(aBrowser, aLocationURI, aFlags, aIsNavigation) {
     let gBrowser = aBrowser.getTabBrowser();
     let document = aBrowser.ownerDocument;
@@ -380,50 +446,6 @@ class ShoppingSidebarManagerClass {
       : "shopping-sidebar-open-button2";
     document.l10n.setAttributes(button, l10nId);
   }
-
-  /**
-   * Called by TabsProgressListener whenever any browser navigates from one
-   * URL to another.
-   * Note that this includes hash changes / pushState navigations, because
-   * those can be significant for us.
-   */
-  onLocationChange(aBrowser, aLocationURI, aFlags) {
-    let isPBM = lazy.PrivateBrowsingUtils.isWindowPrivate(aBrowser.ownerGlobal);
-    if (isPBM) {
-      return;
-    }
-
-    lazy.ShoppingUtils.onLocationChange(aLocationURI, aFlags);
-
-    this._maybeToggleButton(aBrowser.getTabBrowser());
-    this._maybeToggleSidebar(aBrowser, aLocationURI, aFlags, true);
-  }
-
-  handleEvent(event) {
-    switch (event.type) {
-      case "TabSelect": {
-        if (!this.enabled) {
-          return;
-        }
-        this.updateSidebarVisibility();
-        if (event.detail?.previousTab.linkedBrowser) {
-          this._updateBCActiveness(event.detail.previousTab.linkedBrowser);
-        }
-        break;
-      }
-      case "visibilitychange": {
-        if (!this.enabled) {
-          return;
-        }
-        let { gBrowser } = event.target.ownerGlobal.top;
-        if (!gBrowser) {
-          return;
-        }
-        this.updateSidebarVisibilityForWindow(event.target.ownerGlobal.top);
-        this._updateBCActiveness(gBrowser.selectedBrowser);
-      }
-    }
-  }
 }
 
 const ShoppingSidebarManager = new ShoppingSidebarManagerClass();
diff --git a/browser/components/shopping/tests/browser/browser_private_mode.js b/browser/components/shopping/tests/browser/browser_private_mode.js
index 16d7ee733b..9877f4a34b 100644
--- a/browser/components/shopping/tests/browser/browser_private_mode.js
+++ b/browser/components/shopping/tests/browser/browser_private_mode.js
@@ -3,33 +3,63 @@
 
 "use strict";
 
-// This test verifies that the shopping sidebar is not initialized if the
+// These tests verify that the shopping sidebar is not initialized if the
 // user visits a shopping product page while in private browsing mode.
 
-add_task(async function test_private_window_disabled() {
-  let privateWindow = await BrowserTestUtils.openNewBrowserWindow({
-    private: true,
-  });
-
-  let browser = privateWindow.gBrowser.selectedBrowser;
-  BrowserTestUtils.startLoadingURIString(
-    browser,
-    "https://example.com/product/B09TJGHL5F"
-  );
-  await BrowserTestUtils.browserLoaded(browser);
+const PRODUCT_PAGE = "https://example.com/product/Y4YM0Z1LL4";
 
-  let shoppingButton = privateWindow.document.getElementById(
-    "shopping-sidebar-button"
-  );
+let verifyButtonNotShown = win => {
+  let shoppingButton = win.document.getElementById("shopping-sidebar-button");
   ok(
     BrowserTestUtils.isHidden(shoppingButton),
     "Shopping Button should not be visible on a product page"
   );
+};
 
+let verifySidebarNotShown = win => {
   ok(
-    !privateWindow.document.querySelector("shopping-sidebar"),
+    !win.document.querySelector("shopping-sidebar"),
     "Shopping sidebar does not exist"
   );
+};
+
+add_task(async function test_private_window_disabled() {
+  let privateWindow = await BrowserTestUtils.openNewBrowserWindow({
+    private: true,
+  });
+
+  let browser = privateWindow.gBrowser.selectedBrowser;
+  BrowserTestUtils.startLoadingURIString(browser, PRODUCT_PAGE);
+  await BrowserTestUtils.browserLoaded(browser);
+
+  verifyButtonNotShown(privateWindow);
+  verifySidebarNotShown(privateWindow);
+
+  await BrowserTestUtils.closeWindow(privateWindow);
+});
+
+// If a product page is open in a private window, and the feature is
+// preffed on, the sidebar and button should not be shown in the private
+// window (bug 1901979).
+add_task(async function test_bug_1901979_pref_toggle_private_windows() {
+  let privateWindow = await BrowserTestUtils.openNewBrowserWindow({
+    private: true,
+  });
+
+  let browser = privateWindow.gBrowser.selectedBrowser;
+  BrowserTestUtils.startLoadingURIString(browser, PRODUCT_PAGE);
+  await BrowserTestUtils.browserLoaded(browser);
+
+  verifyButtonNotShown(privateWindow);
+  verifySidebarNotShown(privateWindow);
+
+  // Flip the prefs to trigger the bug.
+  Services.prefs.setBoolPref("browser.shopping.experience2023.enabled", false);
+  Services.prefs.setBoolPref("browser.shopping.experience2023.enabled", true);
+
+  // Verify we still haven't displayed the button or sidebar.
+  verifyButtonNotShown(privateWindow);
+  verifySidebarNotShown(privateWindow);
 
   await BrowserTestUtils.closeWindow(privateWindow);
 });
diff --git a/browser/config/version.txt b/browser/config/version.txt
index 4aea959bf8..29810a755b 100644
--- a/browser/config/version.txt
+++ b/browser/config/version.txt
@@ -1 +1 @@
-127.0
+127.0.1
diff --git a/browser/config/version_display.txt b/browser/config/version_display.txt
index 4aea959bf8..29810a755b 100644
--- a/browser/config/version_display.txt
+++ b/browser/config/version_display.txt
@@ -1 +1 @@
-127.0
+127.0.1
diff --git a/build/pgo/server-locations.txt b/build/pgo/server-locations.txt
index 2d97a79f3f..145d353bb9 100644
--- a/build/pgo/server-locations.txt
+++ b/build/pgo/server-locations.txt
@@ -318,6 +318,7 @@ https://mismatch.badcertdomain.example.com:443                    privileged,cer
 # Hosts for HTTPS-First upgrades/downgrades
 http://httpsfirst.com:80                                          privileged
 https://httpsfirst.com:443                                        privileged,nocert
+https://invalid.example.com:443                                   privileged,nocert
 
 # Hosts for sha1 console warning tests
 https://sha1ee.example.com:443                                    privileged,cert=sha1_end_entity
diff --git a/config/milestone.txt b/config/milestone.txt
index 3da78dcd9c..fccd17fbc2 100644
--- a/config/milestone.txt
+++ b/config/milestone.txt
@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-127.0
+127.0.1
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
index b3812eedd3..30ffed97d0 100644
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@@ -24,6 +24,7 @@
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/LoadURIOptionsBinding.h"
+#include "mozilla/dom/nsHTTPSOnlyUtils.h"
 #include "mozilla/StaticPrefs_browser.h"
 #include "mozilla/StaticPrefs_fission.h"
 #include "mozilla/Telemetry.h"
@@ -165,6 +166,7 @@ nsDocShellLoadState::nsDocShellLoadState(const nsDocShellLoadState& aOther)
       mPartitionedPrincipalToInherit(aOther.mPartitionedPrincipalToInherit),
       mForceAllowDataURI(aOther.mForceAllowDataURI),
       mIsExemptFromHTTPSFirstMode(aOther.mIsExemptFromHTTPSFirstMode),
+      mHttpsFirstDowngradeData(aOther.GetHttpsFirstDowngradeData()),
       mOriginalFrameSrc(aOther.mOriginalFrameSrc),
       mIsFormSubmission(aOther.mIsFormSubmission),
       mLoadType(aOther.mLoadType),
@@ -632,6 +634,16 @@ void nsDocShellLoadState::SetIsExemptFromHTTPSFirstMode(
   mIsExemptFromHTTPSFirstMode = aIsExemptFromHTTPSFirstMode;
 }
 
+RefPtr<HTTPSFirstDowngradeData>
+nsDocShellLoadState::GetHttpsFirstDowngradeData() const {
+  return mHttpsFirstDowngradeData;
+}
+
+void nsDocShellLoadState::SetHttpsFirstDowngradeData(
+    RefPtr<HTTPSFirstDowngradeData> const& aHttpsFirstTelemetryData) {
+  mHttpsFirstDowngradeData = aHttpsFirstTelemetryData;
+}
+
 bool nsDocShellLoadState::OriginalFrameSrc() const { return mOriginalFrameSrc; }
 
 void nsDocShellLoadState::SetOriginalFrameSrc(bool aOriginalFrameSrc) {
diff --git a/docshell/base/nsDocShellLoadState.h b/docshell/base/nsDocShellLoadState.h
index 8a8aad5a2c..8b1c430128 100644
--- a/docshell/base/nsDocShellLoadState.h
+++ b/docshell/base/nsDocShellLoadState.h
@@ -24,6 +24,7 @@ class nsIURI;
 class nsIDocShell;
 class nsIChannel;
 class nsIReferrerInfo;
+struct HTTPSFirstDowngradeData;
 namespace mozilla {
 class OriginAttributes;
 template <typename, class>
@@ -148,6 +149,11 @@ class nsDocShellLoadState final {
 
   void SetIsExemptFromHTTPSFirstMode(bool aIsExemptFromHTTPSFirstMode);
 
+  RefPtr<HTTPSFirstDowngradeData> GetHttpsFirstDowngradeData() const;
+
+  void SetHttpsFirstDowngradeData(
+      RefPtr<HTTPSFirstDowngradeData> const& aHttpsFirstTelemetryData);
+
   bool OriginalFrameSrc() const;
 
   void SetOriginalFrameSrc(bool aOriginalFrameSrc);
@@ -484,6 +490,10 @@ class nsDocShellLoadState final {
   // will be exempt from HTTPS-Only-Mode upgrades.
   bool mIsExemptFromHTTPSFirstMode;
 
+  // If set, this load is a HTTPS-First downgrade, and the downgrade data will
+  // be submitted to telemetry later if the load succeeds.
+  RefPtr<HTTPSFirstDowngradeData> mHttpsFirstDowngradeData;
+
   // If this attribute is true, this load corresponds to a frame
   // element loading its original src (or srcdoc) attribute.
   bool mOriginalFrameSrc;
diff --git a/dom/canvas/test/webgl-mochitest/test_renderer_strings.html b/dom/canvas/test/webgl-mochitest/test_renderer_strings.html
index 257a16d45e..ac7d834cac 100644
--- a/dom/canvas/test/webgl-mochitest/test_renderer_strings.html
+++ b/dom/canvas/test/webgl-mochitest/test_renderer_strings.html
@@ -58,6 +58,7 @@ async function testKnownCiStrings() {
       'llvmpipe', // Linux
       'Intel(R) HD Graphics 400', // Mac
       'Apple M1', // Mac
+      'Apple M2', // Mac
       'ANGLE (NVIDIA, NVIDIA GeForce 8800 GTX Direct3D11 vs_5_0 ps_5_0)', // Windows
     ].map(x => x + ', or similar'),
     vendor: [
@@ -69,8 +70,10 @@ async function testKnownCiStrings() {
       'llvmpipe (LLVM 10.0.0, 256 bits)', // Linux
       'Intel(R) UHD Graphics 630', // Mac
       'Apple M1', // Mac
+      'Apple M2', // Mac
       'ANGLE (NVIDIA, NVIDIA Tesla M60 Direct3D11 vs_5_0 ps_5_0, D3D11-23.21.13.9181)', // Windows
       'ANGLE (NVIDIA, NVIDIA Tesla M60 Direct3D11 vs_5_0 ps_5_0, D3D11-30.0.14.7239)', // Windows 11
+      'ANGLE (NVIDIA, NVIDIA Tesla M60 Direct3D11 vs_5_0 ps_5_0, D3D11-31.0.15.3815)', //Windows 11
     ],
     unmasked_vendor: [
       'Qualcomm', // Android
diff --git a/dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp b/dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp
index 381cbf71a8..c471c82e62 100644
--- a/dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp
+++ b/dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp
@@ -285,7 +285,7 @@ MediaResult FFmpegAudioDecoder<LIBAV_VER>::PostProcessOutput(
 
   RefPtr<AudioData> data =
       new AudioData(aSample->mOffset, pts, std::move(audio), numChannels,
-                    samplingRate, numChannels);
+                    samplingRate, mAudioInfo.mChannelMap);
   MOZ_ASSERT(duration == data->mDuration, "must be equal");
   aResults.AppendElement(std::move(data));
 
diff --git a/dom/security/metrics.yaml b/dom/security/metrics.yaml
index d48069e4b1..1fa025f002 100644
--- a/dom/security/metrics.yaml
+++ b/dom/security/metrics.yaml
@@ -14,8 +14,9 @@ httpsfirst:
   upgraded:
     type: counter
     description: >
-      Counts how often a load is marked to be upgraded to HTTPS because of
-      HTTPS-First (`dom.security.https_first` enabled).
+      Counts how often a load is successfully upgraded to HTTPS because of
+      HTTPS-First (`dom.security.https_first` enabled). This does not include
+      loads that get downgraded again.
     bugs:
       - https://bugzilla.mozilla.org/show_bug.cgi?id=1868380
     data_reviews:
@@ -30,9 +31,10 @@ httpsfirst:
   upgraded_schemeless:
     type: counter
     description: >
-      Counts how often a load is marked to be upgraded to HTTPS because of
+      Counts how often a load is successfully upgraded to HTTPS because of
       schemeless HTTPS-First (`dom.security.https_first` disabled, but load
-      marked as schemeless).
+      marked as schemeless). This does not include loads that get downgraded
+      again.
     bugs:
       - https://bugzilla.mozilla.org/show_bug.cgi?id=1868380
     data_reviews:
@@ -48,7 +50,7 @@ httpsfirst:
     type: counter
     description: >
       How many regular HTTPS-First (`dom.security.https_first` enabled)
-      upgrades get downgraded again.
+      upgrades fail and get downgraded again.
     bugs:
       - https://bugzilla.mozilla.org/show_bug.cgi?id=1868380
     data_reviews:
@@ -64,7 +66,7 @@ httpsfirst:
     type: counter
     description: >
       How many schemeless HTTPS-First (`dom.security.https_first` disabled, but
-      load marked as schemeless) upgrades get downgraded again.
+      load marked as schemeless) upgrades fail and get downgraded again.
     bugs:
       - https://bugzilla.mozilla.org/show_bug.cgi?id=1868380
     data_reviews:
@@ -118,8 +120,7 @@ httpsfirst:
     description: >
       If a HTTPS-First (`dom.security.https_first` enabled) upgrade isn't
       successful, measures the timespan between the navigation start and the
-      downgrade. This does not include the case in which the https request times
-      out and the http request sent after 3s gets a response faster.
+      downgrade.
     time_unit: millisecond
     bugs:
       - https://bugzilla.mozilla.org/show_bug.cgi?id=1868380
@@ -137,9 +138,7 @@ httpsfirst:
     description: >
       If a schemeless HTTPS-First (`dom.security.https_first` disabled, but load
       marked as schemeless) upgrade isn't successful, measures the timespan
-      between the navigation start and the downgrade. This does not include the
-      case in which the https request times out and the http request sent after
-      3s gets a response faster.
+      between the navigation start and the downgrade.
     time_unit: millisecond
     bugs:
       - https://bugzilla.mozilla.org/show_bug.cgi?id=1868380
diff --git a/dom/security/nsHTTPSOnlyUtils.cpp b/dom/security/nsHTTPSOnlyUtils.cpp
index 0bc99179dc..b5512d8f78 100644
--- a/dom/security/nsHTTPSOnlyUtils.cpp
+++ b/dom/security/nsHTTPSOnlyUtils.cpp
@@ -448,8 +448,6 @@ bool nsHTTPSOnlyUtils::ShouldUpgradeHttpsFirstRequest(nsIURI* aURI,
     nsHTTPSOnlyUtils::LogLocalizedString("HTTPSFirstSchemeless", params,
                                          nsIScriptError::warningFlag, aLoadInfo,
                                          aURI, true);
-
-    mozilla::glean::httpsfirst::upgraded_schemeless.Add();
   } else {
     nsAutoCString scheme;
 
@@ -464,10 +462,6 @@ bool nsHTTPSOnlyUtils::ShouldUpgradeHttpsFirstRequest(nsIURI* aURI,
         isSpeculative ? "HTTPSOnlyUpgradeSpeculativeConnection"
                       : "HTTPSOnlyUpgradeRequest",
         params, nsIScriptError::warningFlag, aLoadInfo, aURI, true);
-
-    if (!isSpeculative) {
-      mozilla::glean::httpsfirst::upgraded.Add();
-    }
   }
 
   // Set flag so we know that we upgraded the request
@@ -594,7 +588,17 @@ nsHTTPSOnlyUtils::PotentiallyDowngradeHttpsFirstRequest(
                                        nsIScriptError::warningFlag, loadInfo,
                                        uri, true);
 
-  // Record telemety
+  return newURI.forget();
+}
+
+void nsHTTPSOnlyUtils::UpdateLoadStateAfterHTTPSFirstDowngrade(
+    mozilla::net::DocumentLoadListener* aDocumentLoadListener,
+    nsDocShellLoadState* aLoadState) {
+  // We have to exempt the load from HTTPS-First to prevent a upgrade-downgrade
+  // loop
+  aLoadState->SetIsExemptFromHTTPSFirstMode(true);
+
+  // Add downgrade data for later telemetry usage to load state
   nsDOMNavigationTiming* timing = aDocumentLoadListener->GetTiming();
   if (timing) {
     mozilla::TimeStamp navigationStart = timing->GetNavigationStartTimeStamp();
@@ -602,31 +606,60 @@ nsHTTPSOnlyUtils::PotentiallyDowngradeHttpsFirstRequest(
       mozilla::TimeDuration duration =
           mozilla::TimeStamp::Now() - navigationStart;
 
+      nsCOMPtr<nsIChannel> channel = aDocumentLoadListener->GetChannel();
+      nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
+
       bool isPrivateWin =
           loadInfo->GetOriginAttributes().mPrivateBrowsingId > 0;
       bool isSchemeless =
           loadInfo->GetWasSchemelessInput() &&
           !nsHTTPSOnlyUtils::IsHttpsFirstModeEnabled(isPrivateWin);
 
-      using namespace mozilla::glean::httpsfirst;
-      auto downgradedMetric = isSchemeless ? downgraded_schemeless : downgraded;
-      auto downgradedOnTimerMetric =
-          isSchemeless ? downgraded_on_timer_schemeless : downgraded_on_timer;
-      auto downgradeTimeMetric =
-          isSchemeless ? downgrade_time_schemeless : downgrade_time;
-
       nsresult channelStatus;
       channel->GetStatus(&channelStatus);
-      if (channelStatus == NS_ERROR_NET_TIMEOUT_EXTERNAL) {
-        downgradedOnTimerMetric.AddToNumerator();
-      } else {
-        downgradeTimeMetric.AccumulateRawDuration(duration);
-      }
-      downgradedMetric.Add();
+
+      RefPtr downgradeData = mozilla::MakeRefPtr<HTTPSFirstDowngradeData>();
+      downgradeData->downgradeTime = duration;
+      downgradeData->isOnTimer = channelStatus == NS_ERROR_NET_TIMEOUT_EXTERNAL;
+      downgradeData->isSchemeless = isSchemeless;
+      aLoadState->SetHttpsFirstDowngradeData(downgradeData);
     }
   }
+}
 
-  return newURI.forget();
+void nsHTTPSOnlyUtils::SubmitHTTPSFirstTelemetry(
+    nsCOMPtr<nsILoadInfo> const& aLoadInfo,
+    RefPtr<HTTPSFirstDowngradeData> const& aHttpsFirstDowngradeData) {
+  using namespace mozilla::glean::httpsfirst;
+  if (aHttpsFirstDowngradeData) {
+    // Successfully downgraded load
+
+    auto downgradedMetric = aHttpsFirstDowngradeData->isSchemeless
+                                ? downgraded_schemeless
+                                : downgraded;
+    auto downgradedOnTimerMetric = aHttpsFirstDowngradeData->isSchemeless
+                                       ? downgraded_on_timer_schemeless
+                                       : downgraded_on_timer;
+    auto downgradeTimeMetric = aHttpsFirstDowngradeData->isSchemeless
+                                   ? downgrade_time_schemeless
+                                   : downgrade_time;
+
+    if (aHttpsFirstDowngradeData->isOnTimer) {
+      downgradedOnTimerMetric.AddToNumerator();
+    }
+    downgradedMetric.Add();
+    downgradeTimeMetric.AccumulateRawDuration(
+        aHttpsFirstDowngradeData->downgradeTime);
+  } else if (aLoadInfo->GetHttpsOnlyStatus() &
+             nsILoadInfo::HTTPS_ONLY_UPGRADED_HTTPS_FIRST) {
+    // Successfully upgraded load
+
+    if (aLoadInfo->GetWasSchemelessInput()) {
+      upgraded_schemeless.Add();
+    } else {
+      upgraded.Add();
+    }
+  }
 }
 
 /* static */
diff --git a/dom/security/nsHTTPSOnlyUtils.h b/dom/security/nsHTTPSOnlyUtils.h
index 775fbf39e0..d582e62f36 100644
--- a/dom/security/nsHTTPSOnlyUtils.h
+++ b/dom/security/nsHTTPSOnlyUtils.h
@@ -176,6 +176,31 @@ class nsHTTPSOnlyUtils {
    */
   static uint32_t GetStatusForSubresourceLoad(uint32_t aHttpsOnlyStatus);
 
+  /**
+   * When a downgrade is happening because of HTTPS-First, this function will
+   * update the load state for the new load accordingly. This includes
+   * information about the downgrade for later telemetry use.
+   * @param aDocumentLoadListener The calling document load listener.
+   * @param aLoadState The load state to be updated
+   */
+  static void UpdateLoadStateAfterHTTPSFirstDowngrade(
+      mozilla::net::DocumentLoadListener* aDocumentLoadListener,
+      nsDocShellLoadState* aLoadState);
+
+  /**
+   * When a load is successful, this should be called by the document load
+   * listener. In two cases, telemetry is then recorded:
+   * a) If downgrade data has been passed, the passed load is a successful
+   *    downgrade, which means telemetry based on the downgrade data will be
+   *    submitted.
+   * b) If the passed load info indicates that this load has been upgraded by
+   *    HTTPS-First, this means the upgrade was successful, which will be
+   *    recorded to telemetry.
+   */
+  static void SubmitHTTPSFirstTelemetry(
+      nsCOMPtr<nsILoadInfo> const& aLoadInfo,
+      RefPtr<HTTPSFirstDowngradeData> const& aHttpsFirstDowngradeData);
+
  private:
   /**
    * Checks if it can be ruled out that the error has something
@@ -257,4 +282,17 @@ class TestHTTPAnswerRunnable final : public mozilla::Runnable,
   RefPtr<nsITimer> mTimer;
 };
 
+/**
+ * Data about a HTTPS-First downgrade used for Telemetry. We need to store this
+ * instead of directly submitting it when deciding to downgrade, because it is
+ * only interesting for us if the downgraded load is actually succesful.
+ */
+struct HTTPSFirstDowngradeData
+    : public mozilla::RefCounted<HTTPSFirstDowngradeData> {
+  MOZ_DECLARE_REFCOUNTED_TYPENAME(HTTPSFirstDowngradeData)
+  mozilla::TimeDuration downgradeTime;
+  bool isOnTimer = false;
+  bool isSchemeless = false;
+};
+
 #endif /* nsHTTPSOnlyUtils_h___ */
diff --git a/dom/security/test/https-first/browser_httpsfirst.js b/dom/security/test/https-first/browser_httpsfirst.js
index e0bba26f73..060d7d362c 100644
--- a/dom/security/test/https-first/browser_httpsfirst.js
+++ b/dom/security/test/https-first/browser_httpsfirst.js
@@ -90,8 +90,14 @@ add_task(async function () {
     "http://"
   );
 
+  await runPrefTest(
+    "http://invalid.example.com",
+    "Should downgrade non-reachable site.",
+    "http://"
+  );
+
   info("Checking expected telemetry");
-  is(Glean.httpsfirst.upgraded.testGetValue(), 5);
+  is(Glean.httpsfirst.upgraded.testGetValue(), 1);
   is(Glean.httpsfirst.upgradedSchemeless.testGetValue(), null);
   is(Glean.httpsfirst.downgraded.testGetValue(), 3);
   is(Glean.httpsfirst.downgradedSchemeless.testGetValue(), null);
diff --git a/gfx/cairo/libpixman/src/moz.build b/gfx/cairo/libpixman/src/moz.build
index 6d5cee9c8d..8354df8339 100644
--- a/gfx/cairo/libpixman/src/moz.build
+++ b/gfx/cairo/libpixman/src/moz.build
@@ -93,6 +93,8 @@ elif CONFIG['TARGET_CPU'] == 'arm':
             'pixman-arm-simd-asm.S',
             'pixman-arm-simd.c',
         ]
+    if CONFIG['HAVE_ARM_NEON'] or CONFIG['HAVE_ARM_SIMD']:
+        DEFINES['ASM_HAVE_SYNTAX_UNIFIED'] = True
     if CONFIG['OS_TARGET'] == 'Android':
         # For cpu-features.h
         LOCAL_INCLUDES += [
diff --git a/image/test/reftest/generic/reftest.list b/image/test/reftest/generic/reftest.list
index 6729286168..4ef4f419e5 100644
--- a/image/test/reftest/generic/reftest.list
+++ b/image/test/reftest/generic/reftest.list
@@ -3,5 +3,5 @@ skip-if(Android) != moz-icon-1.html about:blank
 == moz-icon-blank-1.html moz-icon-blank-1-ref.html
 skip-if(Android) != moz-icon-blank-1-ref.html moz-icon-blank-1-antiref.html
 skip-if(Android) != moz-icon-blank-1-ref.html moz-icon-blank-1-antiref2.html
-fuzzy-if(cocoaWidget,44-49,335-348) fuzzy-if(winWidget,64-140,45-191) == moz-icon-blank-1-almostref.html moz-icon-blank-1-ref.html
+fuzzy-if(cocoaWidget,44-49,335-348) fuzzy-if(winWidget,64-141,45-191) == moz-icon-blank-1-almostref.html moz-icon-blank-1-ref.html
 pref(image.testing.decode-sync.enabled,false) == 1805599-1.html 1805599-1-ref.html
diff --git a/mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorker.kt b/mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorker.kt
index b30f8b0f4b..9784d9e79e 100644
--- a/mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorker.kt
+++ b/mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorker.kt
@@ -22,16 +22,10 @@ internal class FxSuggestIngestionWorker(
     private val logger = Logger("FxSuggestIngestionWorker")
 
     override suspend fun doWork(): Result {
-        logger.info("Ingesting new suggestions")
-        val storage = GlobalFxSuggestDependencyProvider.requireStorage()
-        val success = storage.ingest()
-        return if (success) {
-            logger.info("Successfully ingested new suggestions")
-            Result.success()
-        } else {
-            logger.error("Failed to ingest new suggestions")
-            Result.retry()
-        }
+        // Disable periodic ingestion until we figure out
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=1900837
+        logger.info("Skipping ingesting new suggestions")
+        return Result.success()
     }
 
     internal companion object {
diff --git a/mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorkerTest.kt b/mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorkerTest.kt
index 84df98f78e..54c1e1dd67 100644
--- a/mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorkerTest.kt
+++ b/mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorkerTest.kt
@@ -18,6 +18,7 @@ import org.junit.Assert.assertEquals
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.mockito.Mockito.never
 import org.mockito.Mockito.verify
 
 @RunWith(AndroidJUnit4::class)
@@ -43,19 +44,9 @@ class FxSuggestIngestionWorkerTest {
 
         val result = worker.startWork().await()
 
-        verify(storage).ingest(any())
+        // Ingestion is disabled until we figure out
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=1900837
+        verify(storage, never()).ingest(any())
         assertEquals(ListenableWorker.Result.success(), result)
     }
-
-    @Test
-    fun workShouldRetry() = runTest {
-        whenever(storage.ingest(any())).thenReturn(false)
-
-        val worker = TestListenableWorkerBuilder<FxSuggestIngestionWorker>(testContext).build()
-
-        val result = worker.startWork().await()
-
-        verify(storage).ingest(any())
-        assertEquals(ListenableWorker.Result.retry(), result)
-    }
 }
diff --git a/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt b/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
index cd367fa467..6d0d37f0a5 100644
--- a/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
+++ b/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
@@ -377,11 +377,15 @@ open class FenixApplication : LocaleAwareApplication(), Provider {
                         // new search suggestions. The worker requires us to have called
                         // `GlobalFxSuggestDependencyProvider.initialize`, which we did before
                         // scheduling these tasks. When disabled we stop the periodic work.
-                        if (settings().enableFxSuggest) {
-                            components.fxSuggest.ingestionScheduler.startPeriodicIngestion()
-                        } else {
-                            components.fxSuggest.ingestionScheduler.stopPeriodicIngestion()
-                        }
+
+                        // Disable periodic ingestion until we figure out
+                        // https://bugzilla.mozilla.org/show_bug.cgi?id=1900837
+                        //
+                        // Note: we will still ingest once for a fresh DB because of
+                        // the `runStartupIngestion()` call below.  This should be okay, the
+                        // performance issues only happen when reingesting after a successful
+                        // initial ingestion.
+                        components.fxSuggest.ingestionScheduler.stopPeriodicIngestion()
                     }
                     components.core.fileUploadsDirCleaner.cleanUploadsDirectory()
                 }
diff --git a/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SecretSettingsFragment.kt b/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SecretSettingsFragment.kt
index c50cbe6a1c..d65133b81d 100644
--- a/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SecretSettingsFragment.kt
+++ b/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SecretSettingsFragment.kt
@@ -5,7 +5,6 @@
 package org.mozilla.fenix.settings
 
 import android.os.Bundle
-import androidx.core.content.edit
 import androidx.lifecycle.lifecycleScope
 import androidx.navigation.fragment.findNavController
 import androidx.preference.EditTextPreference
@@ -16,7 +15,6 @@ import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.launch
 import org.mozilla.fenix.BuildConfig
 import org.mozilla.fenix.Config
-import org.mozilla.fenix.FeatureFlags
 import org.mozilla.fenix.R
 import org.mozilla.fenix.browser.tabstrip.isTabStripEligible
 import org.mozilla.fenix.debugsettings.data.DefaultDebugSettingsRepository
@@ -83,27 +81,6 @@ class SecretSettingsFragment : PreferenceFragmentCompat() {
             onPreferenceChangeListener = SharedPreferenceUpdater()
         }
 
-        requirePreference<SwitchPreference>(R.string.pref_key_enable_fxsuggest).apply {
-            isVisible = FeatureFlags.fxSuggest
-            isChecked = context.settings().enableFxSuggest
-            onPreferenceChangeListener = object : Preference.OnPreferenceChangeListener {
-                override fun onPreferenceChange(preference: Preference, newValue: Any?): Boolean {
-                    val newBooleanValue = newValue as? Boolean ?: return false
-                    val ingestionScheduler =
-                        requireContext().components.fxSuggest.ingestionScheduler
-                    if (newBooleanValue) {
-                        ingestionScheduler.startPeriodicIngestion()
-                    } else {
-                        ingestionScheduler.stopPeriodicIngestion()
-                    }
-                    requireContext().settings().preferences.edit {
-                        putBoolean(preference.key, newBooleanValue)
-                    }
-                    return true
-                }
-            }
-        }
-
         requirePreference<SwitchPreference>(R.string.pref_key_should_enable_felt_privacy).apply {
             isVisible = true
             isChecked = context.settings().feltPrivateBrowsingEnabled
diff --git a/mobile/android/fenix/app/src/main/res/values/static_strings.xml b/mobile/android/fenix/app/src/main/res/values/static_strings.xml
index 6ed8c8901c..d5339548dd 100644
--- a/mobile/android/fenix/app/src/main/res/values/static_strings.xml
+++ b/mobile/android/fenix/app/src/main/res/values/static_strings.xml
@@ -78,8 +78,6 @@
     <string name="preferences_debug_settings_compose_top_sites" translatable="false">Enable Compose Top Sites</string>
     <!-- Label for enabling the menu redesign -->
     <string name="preferences_debug_settings_menu_redesign" translatable="false">Enable Menu Redesign</string>
-    <!-- Label for enabling Firefox Suggest -->
-    <string name="preferences_debug_settings_fxsuggest" translatable="false">Enable Firefox Suggest</string>
     <!-- Label for enabling Toolbar Redesign incomplete portions -->
     <string name="preferences_debug_settings_toolbar_redesign" translatable="false">Enable Toolbar Redesign incomplete portions</string>
     <!-- Label for enabling Felt Privacy -->
diff --git a/mobile/android/fenix/app/src/main/res/xml/secret_settings_preferences.xml b/mobile/android/fenix/app/src/main/res/xml/secret_settings_preferences.xml
index a1774c1204..c1bc03395e 100644
--- a/mobile/android/fenix/app/src/main/res/xml/secret_settings_preferences.xml
+++ b/mobile/android/fenix/app/src/main/res/xml/secret_settings_preferences.xml
@@ -36,11 +36,6 @@
         android:title="@string/preferences_debug_settings_toolbar_redesign"
         app:iconSpaceReserved="false" />
     <SwitchPreference
-        android:defaultValue="false"
-        android:key="@string/pref_key_enable_fxsuggest"
-        android:title="@string/preferences_debug_settings_fxsuggest"
-        app:iconSpaceReserved="false" />
-    <SwitchPreference
         android:key="@string/pref_key_should_enable_felt_privacy"
         app:iconSpaceReserved="false"
         android:title="@string/preferences_debug_felt_privacy"
diff --git a/mobile/android/version.txt b/mobile/android/version.txt
index 4aea959bf8..29810a755b 100644
--- a/mobile/android/version.txt
+++ b/mobile/android/version.txt
@@ -1 +1 @@
-127.0
+127.0.1
diff --git a/netwerk/cookie/CookieService.cpp b/netwerk/cookie/CookieService.cpp
index 78698d44a0..8457a99249 100644
--- a/netwerk/cookie/CookieService.cpp
+++ b/netwerk/cookie/CookieService.cpp
@@ -1624,21 +1624,6 @@ bool CookieService::GetTokenValue(nsACString::const_char_iterator& aIter,
     // if on terminator, increment past & return true to process new cookie
     if (isterminator(*aIter)) {
       ++aIter;
-      while (aIter != aEndIter && isvalueseparator(*aIter)) {
-        ++aIter;
-      }
-      nsACString::const_char_iterator end = aIter - 1;
-      if (!isterminator(*end)) {
-        // The cookie isn't valid because we have multiple terminators or
-        // a terminator followed by a value separator. Add those invalid
-        // characters to the cookie string or value so it will be rejected.
-        if (aEqualsFound) {
-          aTokenString.Rebind(start, end);
-        } else {
-          aTokenValue.Rebind(start, end);
-        }
-        return false;
-      }
       return true;
     }
     // fall-through: aIter is on ';', increment and return false
diff --git a/netwerk/ipc/DocumentLoadListener.cpp b/netwerk/ipc/DocumentLoadListener.cpp
index a133df4663..280348e449 100644
--- a/netwerk/ipc/DocumentLoadListener.cpp
+++ b/netwerk/ipc/DocumentLoadListener.cpp
@@ -644,6 +644,7 @@ auto DocumentLoadListener::Open(nsDocShellLoadState* aLoadState,
   // See description of  mFileName in nsDocShellLoadState.h
   mIsDownload = !aLoadState->FileName().IsVoid();
   mIsLoadingJSURI = net::SchemeIsJavascript(aLoadState->URI());
+  mHTTPSFirstDowngradeData = aLoadState->GetHttpsFirstDowngradeData().forget();
 
   // Check for infinite recursive object or iframe loads
   if (aLoadState->OriginalFrameSrc() || !mIsDocumentLoad) {
@@ -2427,9 +2428,7 @@ bool DocumentLoadListener::MaybeHandleLoadErrorWithURIFixup(nsresult aStatus) {
   loadState->SetWasSchemelessInput(wasSchemelessInput);
 
   if (isHTTPSFirstFixup) {
-    // We have to exempt the load from HTTPS-First to prevent a
-    // upgrade-downgrade loop.
-    loadState->SetIsExemptFromHTTPSFirstMode(true);
+    nsHTTPSOnlyUtils::UpdateLoadStateAfterHTTPSFirstDowngrade(this, loadState);
   }
 
   // Ensure to set referrer information in the fallback channel equally to the
@@ -2571,6 +2570,17 @@ DocumentLoadListener::OnStartRequest(nsIRequest* aRequest) {
     return NS_OK;
   }
 
+  // If this is a successful load with a successful status code, we can possibly
+  // submit HTTPS-First telemetry.
+  if (NS_SUCCEEDED(status) && httpChannel) {
+    uint32_t responseStatus = 0;
+    if (NS_SUCCEEDED(httpChannel->GetResponseStatus(&responseStatus)) &&
+        responseStatus < 400) {
+      nsHTTPSOnlyUtils::SubmitHTTPSFirstTelemetry(
+          mChannel->LoadInfo(), mHTTPSFirstDowngradeData.forget());
+    }
+  }
+
   mStreamListenerFunctions.AppendElement(StreamListenerFunction{
       VariantIndex<0>{}, OnStartRequestParams{aRequest}});
 
diff --git a/netwerk/ipc/DocumentLoadListener.h b/netwerk/ipc/DocumentLoadListener.h
index 6f6ad357ae..69f7eafd0f 100644
--- a/netwerk/ipc/DocumentLoadListener.h
+++ b/netwerk/ipc/DocumentLoadListener.h
@@ -617,6 +617,8 @@ class DocumentLoadListener : public nsIInterfaceRequestor,
   bool mOpenPromiseResolved = false;
 
   const bool mIsDocumentLoad;
+
+  RefPtr<HTTPSFirstDowngradeData> mHTTPSFirstDowngradeData;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(DocumentLoadListener, DOCUMENT_LOAD_LISTENER_IID)
diff --git a/other-licenses/nsis/Plugins/InetBgDL.dll b/other-licenses/nsis/Plugins/InetBgDL.dll
index 6cb91637bd..fa6127631e 100644
--- a/other-licenses/nsis/Plugins/InetBgDL.dll
+++ b/other-licenses/nsis/Plugins/InetBgDL.dll
diff --git a/services/settings/dumps/blocklists/addons-bloomfilters.json b/services/settings/dumps/blocklists/addons-bloomfilters.json
index 6cdec41139..aed250d702 100644
--- a/services/settings/dumps/blocklists/addons-bloomfilters.json
+++ b/services/settings/dumps/blocklists/addons-bloomfilters.json
@@ -3,6 +3,19 @@
     {
       "stash": {
         "blocked": [
+          "{80f72148-c2c1-4690-b9bb-eb49b7e35aad}:1.2"
+        ],
+        "unblocked": []
+      },
+      "schema": 1718040172384,
+      "key_format": "{guid}:{version}",
+      "stash_time": 1718109305604,
+      "id": "5efe9fe9-e815-4eaa-8b3e-399a3c4e27eb",
+      "last_modified": 1718109362020
+    },
+    {
+      "stash": {
+        "blocked": [
           "{a5eff3e0-fd15-4905-8799-a3c8a3a1eb56}:1.6",
           "{437c932f-fa9f-459d-8dab-ea6219d23513}:1.7",
           "{2aeb7e23-47e4-4a41-9125-f5a28e9b62cf}:1.4"
@@ -707,5 +720,5 @@
       "last_modified": 1707395854769
     }
   ],
-  "timestamp": 1717094162111
+  "timestamp": 1718109362020
 }
diff --git a/services/settings/dumps/main/devtools-compatibility-browsers.json b/services/settings/dumps/main/devtools-compatibility-browsers.json
index 0f422a8f37..ccb7f43884 100644
--- a/services/settings/dumps/main/devtools-compatibility-browsers.json
+++ b/services/settings/dumps/main/devtools-compatibility-browsers.json
@@ -1,202 +1,247 @@
 {
   "data": [
     {
-      "name": "Edge",
-      "schema": 1716941107417,
-      "status": "current",
-      "version": "125",
-      "browserid": "edge",
-      "id": "f1147d5f-d690-43d0-879d-117c6ca24a16",
-      "last_modified": 1716966331501
+      "name": "Chrome Android",
+      "schema": 1718237106974,
+      "status": "beta",
+      "version": "127",
+      "browserid": "chrome_android",
+      "id": "cd12d517-e366-4857-88e5-bfcf60d9d538",
+      "last_modified": 1718606078088
     },
     {
       "name": "Firefox",
-      "schema": 1715731507143,
+      "schema": 1718237107359,
       "status": "planned",
-      "version": "129",
+      "version": "130",
       "browserid": "firefox",
-      "id": "aed9aeed-2d00-44d3-9b04-065a3df6af27",
-      "last_modified": 1715839095932
+      "id": "010b69b4-e137-4a3c-8d98-b22d532d0b6a",
+      "last_modified": 1718606078085
     },
     {
       "name": "Firefox for Android",
-      "schema": 1715731507714,
+      "schema": 1718237107716,
       "status": "planned",
-      "version": "129",
+      "version": "130",
       "browserid": "firefox_android",
-      "id": "0e014c85-acab-44d6-8108-3441175573e2",
-      "last_modified": 1715839095930
+      "id": "232a420f-0598-4544-85b1-c72805873b55",
+      "last_modified": 1718606078082
+    },
+    {
+      "name": "Safari",
+      "schema": 1718237107783,
+      "status": "beta",
+      "version": "18",
+      "browserid": "safari",
+      "id": "f2e90b45-68bd-4a1c-8470-6d5c8d934e14",
+      "last_modified": 1718606078080
     },
     {
       "name": "Safari on iOS",
-      "schema": 1715731507984,
-      "status": "current",
-      "version": "17.5",
+      "schema": 1718237107850,
+      "status": "beta",
+      "version": "18",
       "browserid": "safari_ios",
-      "id": "4375a82d-f2f1-4883-8da7-0aedfb05b8f9",
-      "last_modified": 1715839095923
+      "id": "12c2ba11-079f-439f-b326-3350f7999b38",
+      "last_modified": 1718606078077
     },
     {
-      "name": "Safari",
-      "schema": 1715731507854,
+      "name": "WebView Android",
+      "schema": 1718237108052,
+      "status": "beta",
+      "version": "127",
+      "browserid": "webview_android",
+      "id": "51d69a2e-b706-44ca-802d-121d29285060",
+      "last_modified": 1718606078074
+    },
+    {
+      "name": "WebView Android",
+      "schema": 1718237107985,
       "status": "current",
-      "version": "17.5",
-      "browserid": "safari",
-      "id": "24e30aff-fbf8-4a96-a036-84f970447d4b",
-      "last_modified": 1715839095920
+      "version": "126",
+      "browserid": "webview_android",
+      "id": "97b0b530-34a9-4e02-949f-d525bf6bc793",
+      "last_modified": 1718606078065
+    },
+    {
+      "name": "Chrome Android",
+      "schema": 1718237106898,
+      "status": "current",
+      "version": "126",
+      "browserid": "chrome_android",
+      "id": "e8108829-a3d5-4363-86c9-7e9f1015c2fd",
+      "last_modified": 1718606078062
+    },
+    {
+      "name": "Chrome",
+      "schema": 1718237106686,
+      "status": "current",
+      "version": "126",
+      "browserid": "chrome",
+      "id": "329bb17c-2556-40a6-8e88-eb2fe353913a",
+      "last_modified": 1718606078060
     },
     {
       "name": "Firefox",
-      "schema": 1715731506990,
+      "schema": 1718237107202,
       "status": "beta",
-      "version": "127",
+      "version": "128",
       "browserid": "firefox",
-      "id": "1477a1c3-a8be-4e6f-916e-8cf8eb789e3f",
-      "last_modified": 1715839095918
+      "id": "565161dc-52d8-4cb1-8cf3-8171b960f9e4",
+      "last_modified": 1718606078057
     },
     {
       "name": "Firefox for Android",
-      "schema": 1715731507415,
+      "schema": 1718237107577,
       "status": "beta",
-      "version": "127",
+      "version": "128",
       "browserid": "firefox_android",
-      "id": "13f02b93-14c9-4ca4-937d-0a83fb7fb3a5",
-      "last_modified": 1715839095915
+      "id": "05aa43eb-3966-4fc1-8b33-53c493448d2d",
+      "last_modified": 1718606078055
     },
     {
       "name": "Firefox for Android",
-      "schema": 1715731507341,
+      "schema": 1718237107506,
       "status": "current",
-      "version": "126",
+      "version": "127",
       "browserid": "firefox_android",
-      "id": "b77524e9-58dc-4196-acbd-41dddc4daea2",
-      "last_modified": 1715839095908
+      "id": "13f02b93-14c9-4ca4-937d-0a83fb7fb3a5",
+      "last_modified": 1718606078048
     },
     {
       "name": "Firefox",
-      "schema": 1715731506911,
+      "schema": 1718237107126,
       "status": "current",
-      "version": "126",
+      "version": "127",
       "browserid": "firefox",
-      "id": "70b05b0b-bbef-486c-901a-ea3221a28fc1",
-      "last_modified": 1715839095906
+      "id": "1477a1c3-a8be-4e6f-916e-8cf8eb789e3f",
+      "last_modified": 1718606078046
     },
     {
       "name": "Firefox for Android",
-      "schema": 1715731507485,
+      "schema": 1718237107649,
       "status": "nightly",
-      "version": "128",
+      "version": "129",
       "browserid": "firefox_android",
-      "id": "05aa43eb-3966-4fc1-8b33-53c493448d2d",
-      "last_modified": 1715839095903
+      "id": "0e014c85-acab-44d6-8108-3441175573e2",
+      "last_modified": 1718606078044
     },
     {
       "name": "Firefox",
-      "schema": 1715731507063,
+      "schema": 1718237107286,
       "status": "nightly",
-      "version": "128",
+      "version": "129",
       "browserid": "firefox",
-      "id": "565161dc-52d8-4cb1-8cf3-8171b960f9e4",
-      "last_modified": 1715839095900
-    },
-    {
-      "name": "Node.js",
-      "schema": 1715126727137,
-      "status": "current",
-      "version": "22.0.0",
-      "browserid": "nodejs",
-      "id": "c28dfac7-c7de-4e20-8212-abc7c0de635a",
-      "last_modified": 1715589742262
+      "id": "aed9aeed-2d00-44d3-9b04-065a3df6af27",
+      "last_modified": 1718606078041
     },
     {
       "name": "Chrome",
-      "schema": 1715385903539,
+      "schema": 1718237106760,
       "status": "beta",
-      "version": "126",
+      "version": "127",
       "browserid": "chrome",
-      "id": "329bb17c-2556-40a6-8e88-eb2fe353913a",
-      "last_modified": 1715589742259
+      "id": "0e69f9d7-19f6-4c6e-bc36-731da4cee6e3",
+      "last_modified": 1718606078039
     },
     {
-      "name": "Chrome Android",
-      "schema": 1715385903774,
-      "status": "beta",
-      "version": "126",
-      "browserid": "chrome_android",
-      "id": "e8108829-a3d5-4363-86c9-7e9f1015c2fd",
-      "last_modified": 1715589742256
+      "name": "Edge",
+      "schema": 1717286706296,
+      "status": "planned",
+      "version": "128",
+      "browserid": "edge",
+      "id": "edad0482-a612-4019-a601-53dc349514b8",
+      "last_modified": 1718005312987
     },
     {
-      "name": "Opera",
-      "schema": 1715385903851,
-      "status": "nightly",
-      "version": "111",
-      "browserid": "opera",
-      "id": "880cc50c-e430-43ac-aa57-d1f02fae0e30",
-      "last_modified": 1715589742254
+      "name": "Node.js",
+      "schema": 1717286706438,
+      "status": "esr",
+      "version": "20.12.0",
+      "browserid": "nodejs",
+      "id": "93175823-df25-4102-bda0-e45955132cb5",
+      "last_modified": 1718005312984
     },
     {
-      "name": "Opera Android",
-      "schema": 1715385904000,
+      "name": "Deno",
+      "schema": 1717805106873,
       "status": "current",
-      "version": "82",
-      "browserid": "opera_android",
-      "id": "dad8a164-2e60-4363-a9b2-169aa15ea735",
-      "last_modified": 1715589742251
+      "version": "1.44",
+      "browserid": "deno",
+      "id": "ea6c817d-237b-498b-964e-a8ca4668580a",
+      "last_modified": 1718005312981
     },
     {
-      "name": "WebView Android",
-      "schema": 1715385904222,
+      "name": "Edge",
+      "schema": 1717286706151,
       "status": "beta",
       "version": "126",
-      "browserid": "webview_android",
-      "id": "97b0b530-34a9-4e02-949f-d525bf6bc793",
-      "last_modified": 1715589742248
+      "browserid": "edge",
+      "id": "c8bf4918-03b7-4be2-bf75-4d6139dbd7c9",
+      "last_modified": 1718005312974
     },
     {
-      "name": "WebView Android",
-      "schema": 1715385904147,
+      "name": "Edge",
+      "schema": 1717286706227,
+      "status": "nightly",
+      "version": "127",
+      "browserid": "edge",
+      "id": "9e227c6c-b6ca-4c69-868c-e133a0ee9dbd",
+      "last_modified": 1718005312971
+    },
+    {
+      "name": "Edge",
+      "schema": 1716941107417,
       "status": "current",
       "version": "125",
-      "browserid": "webview_android",
-      "id": "c9ec1a0b-5d6d-4727-9f93-fb4dd3f1979f",
-      "last_modified": 1715589742235
+      "browserid": "edge",
+      "id": "f1147d5f-d690-43d0-879d-117c6ca24a16",
+      "last_modified": 1716966331501
     },
     {
-      "name": "Chrome Android",
-      "schema": 1715385903692,
+      "name": "Safari on iOS",
+      "schema": 1715731507984,
       "status": "current",
-      "version": "125",
-      "browserid": "chrome_android",
-      "id": "7cb3db05-b658-4c6c-a57a-c17a1ceefd38",
-      "last_modified": 1715589742230
+      "version": "17.5",
+      "browserid": "safari_ios",
+      "id": "4375a82d-f2f1-4883-8da7-0aedfb05b8f9",
+      "last_modified": 1715839095923
     },
     {
-      "name": "Chrome",
-      "schema": 1715385903420,
+      "name": "Safari",
+      "schema": 1715731507854,
       "status": "current",
-      "version": "125",
-      "browserid": "chrome",
-      "id": "98f20ad9-f47a-476b-b376-be58dbcc76ff",
-      "last_modified": 1715589742227
+      "version": "17.5",
+      "browserid": "safari",
+      "id": "24e30aff-fbf8-4a96-a036-84f970447d4b",
+      "last_modified": 1715839095920
     },
     {
-      "name": "Edge",
-      "schema": 1714867506498,
-      "status": "planned",
-      "version": "127",
-      "browserid": "edge",
-      "id": "9e227c6c-b6ca-4c69-868c-e133a0ee9dbd",
-      "last_modified": 1715003394961
+      "name": "Node.js",
+      "schema": 1715126727137,
+      "status": "current",
+      "version": "22.0.0",
+      "browserid": "nodejs",
+      "id": "c28dfac7-c7de-4e20-8212-abc7c0de635a",
+      "last_modified": 1715589742262
     },
     {
-      "name": "Edge",
-      "schema": 1714867506401,
+      "name": "Opera",
+      "schema": 1715385903851,
       "status": "nightly",
-      "version": "126",
-      "browserid": "edge",
-      "id": "c8bf4918-03b7-4be2-bf75-4d6139dbd7c9",
-      "last_modified": 1715003394956
+      "version": "111",
+      "browserid": "opera",
+      "id": "880cc50c-e430-43ac-aa57-d1f02fae0e30",
+      "last_modified": 1715589742254
+    },
+    {
+      "name": "Opera Android",
+      "schema": 1715385904000,
+      "status": "current",
+      "version": "82",
+      "browserid": "opera_android",
+      "id": "dad8a164-2e60-4363-a9b2-169aa15ea735",
+      "last_modified": 1715589742251
     },
     {
       "name": "Samsung Internet",
@@ -226,24 +271,6 @@
       "last_modified": 1713943930228
     },
     {
-      "name": "Deno",
-      "schema": 1712707507752,
-      "status": "current",
-      "version": "1.42",
-      "browserid": "deno",
-      "id": "a308f3c2-cc19-4a1e-825f-898696606328",
-      "last_modified": 1712840749681
-    },
-    {
-      "name": "Node.js",
-      "schema": 1702685107693,
-      "status": "esr",
-      "version": "20.10.0",
-      "browserid": "nodejs",
-      "id": "0d78585f-e9e0-41e8-816a-22461158e36d",
-      "last_modified": 1702890886929
-    },
-    {
       "name": "Firefox for Android",
       "schema": 1698797104411,
       "status": "esr",
@@ -280,5 +307,5 @@
       "last_modified": 1665656484764
     }
   ],
-  "timestamp": 1716966331504
+  "timestamp": 1718606078088
 }
diff --git a/services/settings/dumps/main/search-telemetry-v2.json b/services/settings/dumps/main/search-telemetry-v2.json
index 1a1708529c..4fc276d018 100644
--- a/services/settings/dumps/main/search-telemetry-v2.json
+++ b/services/settings/dumps/main/search-telemetry-v2.json
@@ -1,95 +1,55 @@
 {
   "data": [
     {
-      "isSPA": true,
-      "schema": 1712762409532,
+      "schema": 1717765743694,
       "components": [
         {
-          "type": "ad_image_row",
+          "type": "ad_carousel",
           "included": {
             "parent": {
-              "selector": "[data-testid='pam.container']"
+              "selector": ".pla-exp-container"
+            },
+            "related": {
+              "selector": "g-right-button, g-left-button, .exp-button"
             },
             "children": [
               {
-                "selector": "[data-slide-index]",
+                "selector": "[data-dtld]",
                 "countChildren": true
               }
             ]
           }
         },
         {
-          "type": "ad_link",
-          "included": {
-            "parent": {
-              "selector": "[data-testid='adResult']"
-            }
-          }
-        },
-        {
-          "type": "incontent_searchbox",
-          "topDown": true,
+          "type": "ad_carousel",
           "included": {
             "parent": {
-              "selector": "._1zdrb._1cR1n"
+              "selector": ".sh-sr__shop-result-group"
             },
             "related": {
-              "selector": "#search-suggestions"
+              "selector": "g-right-button, g-left-button"
             },
             "children": [
               {
-                "selector": "input[type='search']"
+                "selector": ".sh-np__click-target",
+                "countChildren": true
               }
             ]
           }
         },
         {
-          "type": "ad_link",
-          "default": true
-        }
-      ],
-      "taggedCodes": [
-        "brz-moz",
-        "firefoxqwant"
-      ],
-      "telemetryId": "qwant",
-      "organicCodes": [],
-      "codeParamName": "client",
-      "queryParamName": "q",
-      "queryParamNames": [
-        "q"
-      ],
-      "searchPageRegexp": "^https://www\\.qwant\\.com/",
-      "filter_expression": "env.version|versionCompare(\"124.0a1\")>=0",
-      "followOnParamNames": [],
-      "defaultPageQueryParam": {
-        "key": "t",
-        "value": "web"
-      },
-      "extraAdServersRegexps": [
-        "^https://www\\.bing\\.com/acli?c?k",
-        "^https://api\\.qwant\\.com/v3/r/",
-        "^https://fdn\\.qwant\\.com/v3/r/"
-      ],
-      "id": "19c434a3-d173-4871-9743-290ac92a3f6b",
-      "last_modified": 1713187389066
-    },
-    {
-      "schema": 1712582517430,
-      "components": [
-        {
-          "type": "ad_carousel",
+          "type": "refined_search_buttons",
+          "topDown": true,
           "included": {
             "parent": {
-              "selector": ".adsMvCarousel"
+              "selector": "#appbar g-scrolling-carousel"
             },
             "related": {
-              "selector": ".cr"
+              "selector": "g-right-button, g-left-button"
             },
             "children": [
               {
-                "selector": ".pa_item",
-                "countChildren": true
+                "selector": "a"
               }
             ]
           }
@@ -98,17 +58,17 @@
           "type": "ad_link",
           "excluded": {
             "parent": {
-              "selector": "aside"
+              "selector": "#rhs"
             }
           },
           "included": {
             "parent": {
-              "selector": ".sb_adTA"
+              "selector": "[data-text-ad='1']"
             },
             "children": [
               {
                 "type": "ad_sitelink",
-                "selector": ".b_vlist2col"
+                "selector": "[role='list']"
               }
             ]
           }
@@ -117,11 +77,11 @@
           "type": "ad_sidebar",
           "included": {
             "parent": {
-              "selector": "aside"
+              "selector": "#rhs"
             },
             "children": [
               {
-                "selector": ".pa_item, .sb_adTA",
+                "selector": ".pla-unit, .mnr-c",
                 "countChildren": true
               }
             ]
@@ -132,14 +92,36 @@
           "topDown": true,
           "included": {
             "parent": {
-              "selector": "form#sb_form"
+              "selector": "form[role='search']"
             },
             "related": {
-              "selector": "#sw_as"
+              "selector": "div.logo + div + div"
             },
             "children": [
               {
-                "selector": "input[name='q']"
+                "selector": "input[type='text']"
+              },
+              {
+                "selector": "textarea[name='q']"
+              }
+            ]
+          }
+        },
+        {
+          "type": "ad_image_row",
+          "excluded": {
+            "parent": {
+              "selector": ".pla-exp-container"
+            }
+          },
+          "included": {
+            "parent": {
+              "selector": ".top-pla-group-inner"
+            },
+            "children": [
+              {
+                "selector": "[data-dtld]",
+                "countChildren": true
               }
             ]
           }
@@ -149,11 +131,11 @@
           "topDown": true,
           "included": {
             "parent": {
-              "selector": "div#bnp_cookie_banner"
+              "selector": "div.spoKVd"
             },
             "children": [
               {
-                "selector": "button#bnp_btn_accept",
+                "selector": "button#L2AGLb",
                 "eventListeners": [
                   {
                     "action": "clicked_accept",
@@ -162,7 +144,7 @@
                 ]
               },
               {
-                "selector": "button#bnp_btn_reject",
+                "selector": "button#W0wltc",
                 "eventListeners": [
                   {
                     "action": "clicked_reject",
@@ -171,7 +153,7 @@
                 ]
               },
               {
-                "selector": "a#bnp_btn_preference",
+                "selector": "button#VnjCcb",
                 "eventListeners": [
                   {
                     "action": "clicked_more_options",
@@ -188,121 +170,200 @@
         }
       ],
       "shoppingTab": {
-        "regexp": "^/shop?",
-        "selector": "#b-scopeListItem-shop a"
+        "regexp": "&tbm=shop",
+        "selector": "div[role='navigation'] a",
+        "inspectRegexpInSERP": true
       },
       "taggedCodes": [
-        "MOZ2",
-        "MOZ4",
-        "MOZ5",
-        "MOZA",
-        "MOZB",
-        "MOZD",
-        "MOZE",
-        "MOZI",
-        "MOZL",
-        "MOZM",
-        "MOZO",
-        "MOZR",
-        "MOZT",
-        "MOZW",
-        "MOZX",
-        "MZSL01",
-        "MZSL02",
-        "MZSL03"
+        "firefox-a",
+        "firefox-b",
+        "firefox-b-1",
+        "firefox-b-ab",
+        "firefox-b-1-ab",
+        "firefox-b-d",
+        "firefox-b-1-d",
+        "firefox-b-e",
+        "firefox-b-1-e",
+        "firefox-b-m",
+        "firefox-b-1-m",
+        "firefox-b-o",
+        "firefox-b-1-o",
+        "firefox-b-lm",
+        "firefox-b-1-lm",
+        "firefox-b-lg",
+        "firefox-b-huawei-h1611",
+        "firefox-b-is-oem1",
+        "firefox-b-oem1",
+        "firefox-b-oem2",
+        "firefox-b-tinno",
+        "firefox-b-pn-wt",
+        "firefox-b-pn-wt-us",
+        "ubuntu",
+        "ubuntu-sn"
       ],
-      "telemetryId": "bing",
+      "telemetryId": "google",
       "organicCodes": [],
-      "codeParamName": "pc",
+      "codeParamName": "client",
       "queryParamName": "q",
-      "followOnCookies": [
-        {
-          "host": "www.bing.com",
-          "name": "SRCHS",
-          "codeParamName": "PC",
-          "extraCodePrefixes": [
-            "QBRE"
-          ],
-          "extraCodeParamName": "form"
-        }
-      ],
       "queryParamNames": [
         "q"
       ],
+      "signedInCookies": [
+        {
+          "host": "accounts.google.com",
+          "name": "SID"
+        }
+      ],
       "domainExtraction": {
         "ads": [
           {
             "method": "textContent",
-            "selectors": "#b_results .b_ad .b_attribution cite, .adsMvCarousel cite, aside cite"
+            "selectors": ".sh-np__seller-container"
+          },
+          {
+            "method": "dataAttribute",
+            "options": {
+              "dataAttributeKey": "dtld"
+            },
+            "selectors": "[data-dtld]"
           }
         ],
         "nonAds": [
           {
-            "method": "textContent",
-            "selectors": "#b_results .b_algo .b_attribution cite"
+            "method": "href",
+            "options": {
+              "queryParamKey": "url",
+              "queryParamValueIsHref": true
+            },
+            "selectors": ".mnIHsc > a:first-child"
+          },
+          {
+            "method": "href",
+            "selectors": "a[jsname='UWckNb']"
+          },
+          {
+            "method": "dataAttribute",
+            "options": {
+              "dataAttributeKey": "lpage"
+            },
+            "selectors": "[data-id='mosaic'] [data-lpage]"
           }
         ]
       },
-      "searchPageRegexp": "^https://www\\.bing\\.com/search",
+      "searchPageRegexp": "^https://www\\.google\\.(?:.+)/search",
+      "ignoreLinkRegexps": [
+        "^https?://consent\\.google\\.(?:.+)/d\\?continue\\="
+      ],
       "nonAdsLinkRegexps": [
-        "^https://www.bing.com/ck/a"
+        "^https?://www\\.google\\.(?:.+)/url?(?:.+)&url="
+      ],
+      "adServerAttributes": [
+        "rw"
+      ],
+      "followOnParamNames": [
+        "oq",
+        "ved",
+        "ei"
       ],
       "extraAdServersRegexps": [
-        "^https://www\\.bing\\.com/acli?c?k"
+        "^https?://www\\.google(?:adservices)?\\.com/(?:pagead/)?aclk"
       ],
-      "id": "e1eec461-f1f3-40de-b94b-3b670b78108c",
-      "last_modified": 1712762409389
+      "nonAdsLinkQueryParamNames": [
+        "url"
+      ],
+      "id": "635a3325-1995-42d6-be09-dbe4b2a95453",
+      "last_modified": 1718041017650
     },
     {
-      "schema": 1712243919540,
+      "isSPA": true,
+      "schema": 1712762409532,
       "components": [
         {
-          "type": "ad_carousel",
+          "type": "ad_image_row",
           "included": {
             "parent": {
-              "selector": ".pla-exp-container"
-            },
-            "related": {
-              "selector": "g-right-button, g-left-button, .exp-button"
+              "selector": "[data-testid='pam.container']"
             },
             "children": [
               {
-                "selector": "[data-dtld]",
+                "selector": "[data-slide-index]",
                 "countChildren": true
               }
             ]
           }
         },
         {
-          "type": "ad_carousel",
+          "type": "ad_link",
           "included": {
             "parent": {
-              "selector": ".sh-sr__shop-result-group"
+              "selector": "[data-testid='adResult']"
+            }
+          }
+        },
+        {
+          "type": "incontent_searchbox",
+          "topDown": true,
+          "included": {
+            "parent": {
+              "selector": "._1zdrb._1cR1n"
             },
             "related": {
-              "selector": "g-right-button, g-left-button"
+              "selector": "#search-suggestions"
             },
             "children": [
               {
-                "selector": ".sh-np__click-target",
-                "countChildren": true
+                "selector": "input[type='search']"
               }
             ]
           }
         },
         {
-          "type": "refined_search_buttons",
-          "topDown": true,
+          "type": "ad_link",
+          "default": true
+        }
+      ],
+      "taggedCodes": [
+        "brz-moz",
+        "firefoxqwant"
+      ],
+      "telemetryId": "qwant",
+      "organicCodes": [],
+      "codeParamName": "client",
+      "queryParamName": "q",
+      "queryParamNames": [
+        "q"
+      ],
+      "searchPageRegexp": "^https://www\\.qwant\\.com/",
+      "filter_expression": "env.version|versionCompare(\"124.0a1\")>=0",
+      "followOnParamNames": [],
+      "defaultPageQueryParam": {
+        "key": "t",
+        "value": "web"
+      },
+      "extraAdServersRegexps": [
+        "^https://www\\.bing\\.com/acli?c?k",
+        "^https://api\\.qwant\\.com/v3/r/",
+        "^https://fdn\\.qwant\\.com/v3/r/"
+      ],
+      "id": "19c434a3-d173-4871-9743-290ac92a3f6b",
+      "last_modified": 1713187389066
+    },
+    {
+      "schema": 1712582517430,
+      "components": [
+        {
+          "type": "ad_carousel",
           "included": {
             "parent": {
-              "selector": "#appbar g-scrolling-carousel"
+              "selector": ".adsMvCarousel"
             },
             "related": {
-              "selector": "g-right-button, g-left-button"
+              "selector": ".cr"
             },
             "children": [
               {
-                "selector": "a"
+                "selector": ".pa_item",
+                "countChildren": true
               }
             ]
           }
@@ -311,17 +372,17 @@
           "type": "ad_link",
           "excluded": {
             "parent": {
-              "selector": "#rhs"
+              "selector": "aside"
             }
           },
           "included": {
             "parent": {
-              "selector": "[data-text-ad='1']"
+              "selector": ".sb_adTA"
             },
             "children": [
               {
                 "type": "ad_sitelink",
-                "selector": "[role='list']"
+                "selector": ".b_vlist2col"
               }
             ]
           }
@@ -330,11 +391,11 @@
           "type": "ad_sidebar",
           "included": {
             "parent": {
-              "selector": "#rhs"
+              "selector": "aside"
             },
             "children": [
               {
-                "selector": ".pla-unit, .mnr-c",
+                "selector": ".pa_item, .sb_adTA",
                 "countChildren": true
               }
             ]
@@ -345,36 +406,14 @@
           "topDown": true,
           "included": {
             "parent": {
-              "selector": "form[role='search']"
+              "selector": "form#sb_form"
             },
             "related": {
-              "selector": "div.logo + div + div"
-            },
-            "children": [
-              {
-                "selector": "input[type='text']"
-              },
-              {
-                "selector": "textarea[name='q']"
-              }
-            ]
-          }
-        },
-        {
-          "type": "ad_image_row",
-          "excluded": {
-            "parent": {
-              "selector": ".pla-exp-container"
-            }
-          },
-          "included": {
-            "parent": {
-              "selector": ".top-pla-group-inner"
+              "selector": "#sw_as"
             },
             "children": [
               {
-                "selector": "[data-dtld]",
-                "countChildren": true
+                "selector": "input[name='q']"
               }
             ]
           }
@@ -384,11 +423,11 @@
           "topDown": true,
           "included": {
             "parent": {
-              "selector": "div.spoKVd"
+              "selector": "div#bnp_cookie_banner"
             },
             "children": [
               {
-                "selector": "button#L2AGLb",
+                "selector": "button#bnp_btn_accept",
                 "eventListeners": [
                   {
                     "action": "clicked_accept",
@@ -397,7 +436,7 @@
                 ]
               },
               {
-                "selector": "button#W0wltc",
+                "selector": "button#bnp_btn_reject",
                 "eventListeners": [
                   {
                     "action": "clicked_reject",
@@ -406,7 +445,7 @@
                 ]
               },
               {
-                "selector": "button#VnjCcb",
+                "selector": "a#bnp_btn_preference",
                 "eventListeners": [
                   {
                     "action": "clicked_more_options",
@@ -423,41 +462,44 @@
         }
       ],
       "shoppingTab": {
-        "regexp": "&tbm=shop",
-        "selector": "div[role='navigation'] a",
-        "inspectRegexpInSERP": true
+        "regexp": "^/shop?",
+        "selector": "#b-scopeListItem-shop a"
       },
       "taggedCodes": [
-        "firefox-a",
-        "firefox-b",
-        "firefox-b-1",
-        "firefox-b-ab",
-        "firefox-b-1-ab",
-        "firefox-b-d",
-        "firefox-b-1-d",
-        "firefox-b-e",
-        "firefox-b-1-e",
-        "firefox-b-m",
-        "firefox-b-1-m",
-        "firefox-b-o",
-        "firefox-b-1-o",
-        "firefox-b-lm",
-        "firefox-b-1-lm",
-        "firefox-b-lg",
-        "firefox-b-huawei-h1611",
-        "firefox-b-is-oem1",
-        "firefox-b-oem1",
-        "firefox-b-oem2",
-        "firefox-b-tinno",
-        "firefox-b-pn-wt",
-        "firefox-b-pn-wt-us",
-        "ubuntu",
-        "ubuntu-sn"
+        "MOZ2",
+        "MOZ4",
+        "MOZ5",
+        "MOZA",
+        "MOZB",
+        "MOZD",
+        "MOZE",
+        "MOZI",
+        "MOZL",
+        "MOZM",
+        "MOZO",
+        "MOZR",
+        "MOZT",
+        "MOZW",
+        "MOZX",
+        "MZSL01",
+        "MZSL02",
+        "MZSL03"
       ],
-      "telemetryId": "google",
+      "telemetryId": "bing",
       "organicCodes": [],
-      "codeParamName": "client",
+      "codeParamName": "pc",
       "queryParamName": "q",
+      "followOnCookies": [
+        {
+          "host": "www.bing.com",
+          "name": "SRCHS",
+          "codeParamName": "PC",
+          "extraCodePrefixes": [
+            "QBRE"
+          ],
+          "extraCodeParamName": "form"
+        }
+      ],
       "queryParamNames": [
         "q"
       ],
@@ -465,61 +507,25 @@
         "ads": [
           {
             "method": "textContent",
-            "selectors": ".sh-np__seller-container"
-          },
-          {
-            "method": "dataAttribute",
-            "options": {
-              "dataAttributeKey": "dtld"
-            },
-            "selectors": "[data-dtld]"
+            "selectors": "#b_results .b_ad .b_attribution cite, .adsMvCarousel cite, aside cite"
           }
         ],
         "nonAds": [
           {
-            "method": "href",
-            "options": {
-              "queryParamKey": "url",
-              "queryParamValueIsHref": true
-            },
-            "selectors": ".mnIHsc > a:first-child"
-          },
-          {
-            "method": "href",
-            "selectors": "a[jsname='UWckNb']"
-          },
-          {
-            "method": "dataAttribute",
-            "options": {
-              "dataAttributeKey": "lpage"
-            },
-            "selectors": "[data-id='mosaic'] [data-lpage]"
+            "method": "textContent",
+            "selectors": "#b_results .b_algo .b_attribution cite"
           }
         ]
       },
-      "searchPageRegexp": "^https://www\\.google\\.(?:.+)/search",
-      "ignoreLinkRegexps": [
-        "^https?://consent\\.google\\.(?:.+)/d\\?continue\\="
-      ],
+      "searchPageRegexp": "^https://www\\.bing\\.com/search",
       "nonAdsLinkRegexps": [
-        "^https?://www\\.google\\.(?:.+)/url?(?:.+)&url="
-      ],
-      "adServerAttributes": [
-        "rw"
-      ],
-      "followOnParamNames": [
-        "oq",
-        "ved",
-        "ei"
+        "^https://www.bing.com/ck/a"
       ],
       "extraAdServersRegexps": [
-        "^https?://www\\.google(?:adservices)?\\.com/(?:pagead/)?aclk"
-      ],
-      "nonAdsLinkQueryParamNames": [
-        "url"
+        "^https://www\\.bing\\.com/acli?c?k"
       ],
-      "id": "635a3325-1995-42d6-be09-dbe4b2a95453",
-      "last_modified": 1712582517281
+      "id": "e1eec461-f1f3-40de-b94b-3b670b78108c",
+      "last_modified": 1712762409389
     },
     {
       "schema": 1705363206938,
@@ -786,5 +792,5 @@
       "last_modified": 1698666532324
     }
   ],
-  "timestamp": 1713187389066
+  "timestamp": 1718041017650
 }
diff --git a/services/settings/dumps/security-state/intermediates.json b/services/settings/dumps/security-state/intermediates.json
index 49a76e2cec..c3f3a44fc6 100644
--- a/services/settings/dumps/security-state/intermediates.json
+++ b/services/settings/dumps/security-state/intermediates.json
@@ -1,6 +1,42 @@
 {
   "data": [
     {
+      "schema": 1718419986483,
+      "derHash": "iA+8RP5xqhvkDbEwkXsbrsG9iJsrPXR47aBHKGZ+i0Q=",
+      "subject": "CN=GoDaddy Secure Certificate Authority - G5,O=GoDaddy Inc.,C=US",
+      "subjectDN": "MFgxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxHb0RhZGR5IEluYy4xMjAwBgNVBAMTKUdvRGFkZHkgU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEc1",
+      "whitelist": false,
+      "attachment": {
+        "hash": "b0ab60886b732344120e026a516f1347e7b00beb8696ea917d500d651dfe8aa9",
+        "size": 1983,
+        "filename": "xHVm0DkmnVuuM9hP1BXFOradZUCdIX-phuSB2CBWNiU=.pem",
+        "location": "security-state-staging/intermediates/848610e4-7c79-4502-9bb9-fd3613ddd9ba.pem",
+        "mimetype": "application/x-pem-file"
+      },
+      "pubKeyHash": "xHVm0DkmnVuuM9hP1BXFOradZUCdIX+phuSB2CBWNiU=",
+      "crlite_enrolled": false,
+      "id": "e91fe4d1-97c5-4d44-b3b9-eeafa19ab96f",
+      "last_modified": 1718420223252
+    },
+    {
+      "schema": 1718419986168,
+      "derHash": "KeUCmVMQQDaF3WJY+dBIVoeJYwQtR0nG1dl3OjEMMcA=",
+      "subject": "CN=Starfield Secure Certificate Authority - G5,O=Starfield Technologies\\, Inc.,C=US",
+      "subjectDN": "MGoxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTQwMgYDVQQDEytTdGFyZmllbGQgU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEc1",
+      "whitelist": false,
+      "attachment": {
+        "hash": "1ab16093c00cfeb6b1281bd3570ee31b90544dbe82866716c4e0dc4dd23c0850",
+        "size": 2040,
+        "filename": "ZopoHb_DFyTNtOnoOeDm_G07T5xn8PEj_4_f_lJ927A=.pem",
+        "location": "security-state-staging/intermediates/3bb146a9-b858-4d9e-84a3-4898d6729add.pem",
+        "mimetype": "application/x-pem-file"
+      },
+      "pubKeyHash": "ZopoHb/DFyTNtOnoOeDm/G07T5xn8PEj/4/f/lJ927A=",
+      "crlite_enrolled": false,
+      "id": "c56b52a8-0671-4599-8084-0cb8e9fc79e8",
+      "last_modified": 1718420223250
+    },
+    {
       "schema": 1717559643220,
       "derHash": "zBufnkNw+2gUHSihFeqoY/jq23oE4r0js8YvnZ8XwmM=",
       "subject": "CN=FIRMAPROFESIONAL ICA A01 QWAC 2022,O=Firmaprofesional SA,C=ES",
@@ -9559,42 +9595,6 @@
       "last_modified": 1666727873688
     },
     {
-      "schema": 1666727429335,
-      "derHash": "MaCWocuRiHbuV8hbI0n8nMLCy0/Pm903eHzp2levR5A=",
-      "subject": "CN=Alibaba Cloud GCC R3 TLS OV CA 2021,O=Alibaba Cloud Computing Co.\\, Ltd.,C=CN",
-      "subjectDN": "MGcxCzAJBgNVBAYTAkNOMSowKAYDVQQKEyFBbGliYWJhIENsb3VkIENvbXB1dGluZyBDby4sIEx0ZC4xLDAqBgNVBAMTI0FsaWJhYmEgQ2xvdWQgR0NDIFIzIFRMUyBPViBDQSAyMDIx",
-      "whitelist": false,
-      "attachment": {
-        "hash": "c64bbdc4fcc4298ffb453c1558ab7102e685784efb5cc1dae31840e3a119e67a",
-        "size": 1735,
-        "filename": "HacabMO6K4pM-shfB1EkMCGhH2TSlSvVizEDPU1Ruso=.pem",
-        "location": "security-state-staging/intermediates/f8675c4a-871f-4996-b046-3c346fb294db.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "HacabMO6K4pM+shfB1EkMCGhH2TSlSvVizEDPU1Ruso=",
-      "crlite_enrolled": false,
-      "id": "136cca7b-196b-4678-a6b0-4b880a8df6c5",
-      "last_modified": 1666727873674
-    },
-    {
-      "schema": 1666727396635,
-      "derHash": "HdCVRJ/7PP8UsiJNWWuD/ULytHaDVTx5fREVDJGGkb0=",
-      "subject": "CN=GlobalSign Atlas R3 DV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFgxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS4wLAYDVQQDEyVHbG9iYWxTaWduIEF0bGFzIFIzIERWIFRMUyBDQSBIMiAyMDIx",
-      "whitelist": false,
-      "attachment": {
-        "hash": "e06bf97fe011b418ca619844016454cc4529a0fe9de1bf1ec3daa57af5a3a724",
-        "size": 1715,
-        "filename": "P_B6nUOG4cUlLNI8o81n2MESbUnYMzT49Flc6X5W1bk=.pem",
-        "location": "security-state-staging/intermediates/f804d5ba-d989-47f7-8217-4f41b5fb5978.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "P/B6nUOG4cUlLNI8o81n2MESbUnYMzT49Flc6X5W1bk=",
-      "crlite_enrolled": false,
-      "id": "308fb64b-a058-4676-aa68-e8e33b332c2f",
-      "last_modified": 1666727873661
-    },
-    {
       "schema": 1666727359631,
       "derHash": "R7LvvDZw59tLQfIsUfwC7oT7Lb8wgqSfLCaIEi6SEKE=",
       "subject": "CN=emSign SSL CA - G1,OU=emSign PKI,O=eMudhra Technologies Limited,C=IN",
@@ -9775,24 +9775,6 @@
       "last_modified": 1666727873463
     },
     {
-      "schema": 1666727407351,
-      "derHash": "ThpWTHGgQoiXDlPAN9HPwlwfm+/FJ2zzvVAe4mLwQgI=",
-      "subject": "CN=GlobalSign Atlas R3 OV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFgxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS4wLAYDVQQDEyVHbG9iYWxTaWduIEF0bGFzIFIzIE9WIFRMUyBDQSBIMiAyMDIx",
-      "whitelist": false,
-      "attachment": {
-        "hash": "d499679a13f287b719305ece5b064b2730137bf3006a9913e7ab121e378f3262",
-        "size": 1715,
-        "filename": "D2Dxjr_K2WrUouIXuBMldR6ucBSdBjfQI6boJU6R6i8=.pem",
-        "location": "security-state-staging/intermediates/fae57392-fd90-4733-a1bb-c543b9e8ff29.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "D2Dxjr/K2WrUouIXuBMldR6ucBSdBjfQI6boJU6R6i8=",
-      "crlite_enrolled": false,
-      "id": "105b6627-b2cd-462b-8da2-204dc969ac8c",
-      "last_modified": 1666727873449
-    },
-    {
       "schema": 1666727359279,
       "derHash": "k6B4mNibLMoWa6bx+KFBOM5Dgo5JG4MZJryCR9ORzHI=",
       "subject": "CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\\, Inc.,L=Scottsdale,ST=Arizona,C=US",
@@ -10729,24 +10711,6 @@
       "last_modified": 1666727872580
     },
     {
-      "schema": 1666727380169,
-      "derHash": "kK8bYaCCZipjnKpoxqP7Qeu6N2DDUaSh6J+22srUhvw=",
-      "subject": "CN=GlobalSign Atlas ECCR5 OV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFsxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTEwLwYDVQQDEyhHbG9iYWxTaWduIEF0bGFzIEVDQ1I1IE9WIFRMUyBDQSBIMiAyMDIx",
-      "whitelist": false,
-      "attachment": {
-        "hash": "cd5cf65b5f603e9fadcbf6fb536bc9043b3881094161a4a6e0b15cb311a3ed46",
-        "size": 1272,
-        "filename": "WZLG43M_xjDLnY1jaF9kQcG-7bpQC8fM0xt9RK4n3dY=.pem",
-        "location": "security-state-staging/intermediates/626980a9-463c-4a9d-891e-45a1de9a7525.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "WZLG43M/xjDLnY1jaF9kQcG+7bpQC8fM0xt9RK4n3dY=",
-      "crlite_enrolled": false,
-      "id": "bfebb62d-c09f-4bec-9fe4-bfa95ea3ef7b",
-      "last_modified": 1666727872565
-    },
-    {
       "schema": 1666727424275,
       "derHash": "CbwbE3wDEjnveIZz6U6xf18+yrB9Otv7SF51q/qvO5o=",
       "subject": "CN=GlobalSign Domain Validation CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE",
@@ -13627,24 +13591,6 @@
       "last_modified": 1666727869830
     },
     {
-      "schema": 1666727418384,
-      "derHash": "EbbbW2jc3zRHmufnt7uqcWWQVXetg9R08ruXF84kTOo=",
-      "subject": "CN=GlobalSign Atlas R3 AlphaSSL CA H2 2021,O=Globalsign nv-sa,C=BE",
-      "subjectDN": "MFoxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxzaWduIG52LXNhMTAwLgYDVQQDEydHbG9iYWxTaWduIEF0bGFzIFIzIEFscGhhU1NMIENBIEgyIDIwMjE=",
-      "whitelist": false,
-      "attachment": {
-        "hash": "9cf02d5a547d487093c6600cddc45835d2265d1a9e325589d4fc84f0f6d7d961",
-        "size": 1715,
-        "filename": "xecaLv-HFBkn7bPt0j9a3x6oQIAxlTk0PaC8CEgAAK8=.pem",
-        "location": "security-state-staging/intermediates/60d13cbe-72e2-4434-bd54-82eab5032874.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "xecaLv+HFBkn7bPt0j9a3x6oQIAxlTk0PaC8CEgAAK8=",
-      "crlite_enrolled": false,
-      "id": "ff529e2f-a01e-4a10-b6be-ec1b7f25db92",
-      "last_modified": 1666727869816
-    },
-    {
       "schema": 1666727423438,
       "derHash": "EAU3DtJ2sM7zkkTp5pnOSAe/mt4Fv6WfJjgJ+0YGtyw=",
       "subject": "CN=Prodrive Technologies GCC R3 OV TLS CA 2022,O=Prodrive Technologies B.V.,C=NL",
@@ -19693,60 +19639,6 @@
       "last_modified": 1665665823256
     },
     {
-      "schema": 1665578919085,
-      "derHash": "ROaDV24clg14TRe7IyXCXPG+TiBHDDHZ1zys7Ulslck=",
-      "subject": "CN=GlobalSign Atlas E46 EV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFkxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS8wLQYDVQQDEyZHbG9iYWxTaWduIEF0bGFzIEU0NiBFViBUTFMgQ0EgSDIgMjAyMQ==",
-      "whitelist": false,
-      "attachment": {
-        "hash": "6cd9e29057bbe5b64edf3377a6113b0eaccbd584246dad3b5bd7e028d89f27c9",
-        "size": 1252,
-        "filename": "M57F0Wnxzruxx2skIABzM3bhMc1XFcJ5OmPMfoX_2Kw=.pem",
-        "location": "security-state-staging/intermediates/1bbcc3cd-f827-4861-a10e-95361d1c9110.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "M57F0Wnxzruxx2skIABzM3bhMc1XFcJ5OmPMfoX/2Kw=",
-      "crlite_enrolled": false,
-      "id": "a7237377-ea8a-421a-9e89-eb5e456457e7",
-      "last_modified": 1665579462842
-    },
-    {
-      "schema": 1665557823626,
-      "derHash": "Crsc3lPMrBcEg9r808258mIrp+R9MewP09snG0qqUwM=",
-      "subject": "CN=GlobalSign Atlas R6 EV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFgxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS4wLAYDVQQDEyVHbG9iYWxTaWduIEF0bGFzIFI2IEVWIFRMUyBDQSBIMiAyMDIx",
-      "whitelist": false,
-      "attachment": {
-        "hash": "d6a647a904b2296b2de421924aee6694ee9acef681494c12c051da05b878733b",
-        "size": 2406,
-        "filename": "0mvzohE9hsg2CJwQhrPuumD2oI7MvADSjcdM3IhnqV4=.pem",
-        "location": "security-state-staging/intermediates/2e408e2e-ba52-4bfd-8fce-a7fcfe0075be.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "0mvzohE9hsg2CJwQhrPuumD2oI7MvADSjcdM3IhnqV4=",
-      "crlite_enrolled": false,
-      "id": "8ebb9dc6-96b6-48c7-a893-297551984569",
-      "last_modified": 1665579462830
-    },
-    {
-      "schema": 1665578919278,
-      "derHash": "OFqgChhI+Af2ZVYeiIsNT2lhQFLYJfPDOXDgD0w2WN0=",
-      "subject": "CN=GlobalSign Atlas R46 EV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFkxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS8wLQYDVQQDEyZHbG9iYWxTaWduIEF0bGFzIFI0NiBFViBUTFMgQ0EgSDIgMjAyMQ==",
-      "whitelist": false,
-      "attachment": {
-        "hash": "6af7c086768ea998be52398129400eb39d0f5d4eb9230e1c2c7a9f228d5f6d58",
-        "size": 2398,
-        "filename": "6kj_jfSE7hoAQjieaM0YreYi-NU25dfVW4X5EvPet-c=.pem",
-        "location": "security-state-staging/intermediates/5719a806-1c18-46c8-9229-0f467fd98968.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "6kj/jfSE7hoAQjieaM0YreYi+NU25dfVW4X5EvPet+c=",
-      "crlite_enrolled": false,
-      "id": "51e492fd-63e9-4386-9e4c-107cf4cc16b1",
-      "last_modified": 1665579462816
-    },
-    {
       "schema": 1665168564306,
       "derHash": "NkeqwrKCvJQf56ZC49y5nPxbPG3OlEoelvgCjom3sJA=",
       "subject": "CN=GTS CA 2P2,O=Google Trust Services LLC,C=US",
@@ -26173,24 +26065,6 @@
       "last_modified": 1647658653936
     },
     {
-      "schema": 1647442638278,
-      "derHash": "slTzzerx0pq1PLQ56A+5lvHpCig+m1CFuHSdGOT1mHs=",
-      "subject": "CN=GlobalSign Atlas R3 DV ACME CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFkxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS8wLQYDVQQDEyZHbG9iYWxTaWduIEF0bGFzIFIzIERWIEFDTUUgQ0EgSDIgMjAyMQ==",
-      "whitelist": false,
-      "attachment": {
-        "hash": "9b7764d2dd9d44f3454ff2c69278ccacf175873333cb4bc22bb78001354c66f5",
-        "size": 1715,
-        "filename": "Drirt5siv6auOz2CsdX1ih0Gq_A2hFkwS82cYSyOOSc=.pem",
-        "location": "security-state-staging/intermediates/be7d54ce-f543-44f1-8741-28214b2ee3cd.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "Drirt5siv6auOz2CsdX1ih0Gq/A2hFkwS82cYSyOOSc=",
-      "crlite_enrolled": false,
-      "id": "1ea36836-d34e-48ad-a1c3-679ebae83102",
-      "last_modified": 1647464240149
-    },
-    {
       "schema": 1647442123610,
       "derHash": "gCRH7lIcxmbNt7uuk6OF5V8gDXaj0TVqhURaxMvb7RI=",
       "subject": "CN=Cybertrust Global Root,O=Cybertrust\\, Inc",
@@ -27865,42 +27739,6 @@
       "last_modified": 1624913855021
     },
     {
-      "schema": 1623916924551,
-      "derHash": "aRbakW7hsemMsx7pRzDuzX8sB3llvbjU4Wo7gcWKKbY=",
-      "subject": "CN=GlobalSign Atlas ECCR5 DV TLS CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFsxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTEwLwYDVQQDEyhHbG9iYWxTaWduIEF0bGFzIEVDQ1I1IERWIFRMUyBDQSBIMiAyMDIx",
-      "whitelist": false,
-      "attachment": {
-        "hash": "abdf25b3a11dd96af2217032fe2da76890e22dc7b40e8981301a8971d97f32a9",
-        "size": 1268,
-        "filename": "6-g1TUJXD0WhY01dlTAcFTi6R1z-L4XP4pPgJVUTHfA=.pem",
-        "location": "security-state-staging/intermediates/2ff02552-6c42-4558-bb97-ca531ec69f7d.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "6+g1TUJXD0WhY01dlTAcFTi6R1z+L4XP4pPgJVUTHfA=",
-      "crlite_enrolled": false,
-      "id": "7760e5f2-11cf-4582-8639-e223f057cafa",
-      "last_modified": 1623920278097
-    },
-    {
-      "schema": 1623916935947,
-      "derHash": "YbMM6uoMjGOXw1mYKYCctzyo+Be7nN8ADXRT5EJDgCg=",
-      "subject": "CN=GlobalSign Atlas ECCR5 DV ACME CA H2 2021,O=GlobalSign nv-sa,C=BE",
-      "subjectDN": "MFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEF0bGFzIEVDQ1I1IERWIEFDTUUgQ0EgSDIgMjAyMQ==",
-      "whitelist": false,
-      "attachment": {
-        "hash": "edb2ab3c9beabe368a1a743918ee6b2a8507da3e116b951154f6dcbac67de73c",
-        "size": 1272,
-        "filename": "N3T01UrP_szopZ--ULwPC9MuquTStnfM28bhLKuZ1rY=.pem",
-        "location": "security-state-staging/intermediates/8859905c-00e5-4d2a-b3f0-e00fa03ce62c.pem",
-        "mimetype": "application/x-pem-file"
-      },
-      "pubKeyHash": "N3T01UrP/szopZ++ULwPC9MuquTStnfM28bhLKuZ1rY=",
-      "crlite_enrolled": false,
-      "id": "bbc79d7d-1abd-4027-8cae-092d0491fd43",
-      "last_modified": 1623920278014
-    },
-    {
       "schema": 1622555926542,
       "derHash": "COfqyZimLEFVzEy8Xtoy9bQaEsAS8pqzQzvTZjSBSfA=",
       "subject": "CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL",
@@ -31015,5 +30853,5 @@
       "last_modified": 1559865884636
     }
   ],
-  "timestamp": 1717559823094
+  "timestamp": 1718553423053
 }
diff --git a/services/settings/dumps/security-state/onecrl.json b/services/settings/dumps/security-state/onecrl.json
index 48e394966a..7d2a203473 100644
--- a/services/settings/dumps/security-state/onecrl.json
+++ b/services/settings/dumps/security-state/onecrl.json
@@ -1,6 +1,201 @@
 {
   "data": [
     {
+      "schema": 1717606866930,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
+      "serialNumber": "eSmbgvwPOlXGliHHuCIbXw==",
+      "id": "322dfa7b-ab66-40bf-af29-e32a6dd7cd93",
+      "last_modified": 1717704918940
+    },
+    {
+      "schema": 1717606866367,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
+      "serialNumber": "fSpKUE1MI+QbVqikKzCRCw==",
+      "id": "4c28c51a-6db7-4899-99ae-0b6ac61202ea",
+      "last_modified": 1717704918936
+    },
+    {
+      "schema": 1717606866751,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MHsxCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSEwHwYDVQQDDBhBQUEgQ2VydGlmaWNhdGUgU2VydmljZXM=",
+      "serialNumber": "fHxdvf2CERpzvs38JwG48A==",
+      "id": "2b8c2141-f0e1-4506-8d7a-be0e41acde66",
+      "last_modified": 1717704918933
+    },
+    {
+      "schema": 1717606866284,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9WYWRpcyBSb290IENBIDI=",
+      "serialNumber": "dUFRzBHsibZGSbIwrYCQILseZqU=",
+      "id": "e6a81ddf-cf32-4846-8a91-42e9b1285627",
+      "last_modified": 1717704918929
+    },
+    {
+      "schema": 1717581426701,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MDQxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25h",
+      "serialNumber": "OUcWep55zFAPGqHlCF5J5BJKEic=",
+      "id": "891e1719-0bf5-45a9-b61b-7f694feb7804",
+      "last_modified": 1717704918925
+    },
+    {
+      "schema": 1717606866455,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
+      "serialNumber": "eEqpJrbnW++td7NIAblS0A==",
+      "id": "d7fdf988-5bbb-43b1-99df-b5cb534ba121",
+      "last_modified": 1717704918922
+    },
+    {
+      "schema": 1717606866845,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MFoxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMDgxMDAwMzYxGTAXBgNVBAMMEENlcnRpZ25hIFJvb3QgQ0E=",
+      "serialNumber": "Sv8S1Opltybu6pB7fMV4c4tDJxA=",
+      "id": "e2f17410-dc20-4840-b4d9-a345f83cffe9",
+      "last_modified": 1717704918918
+    },
+    {
+      "schema": 1717606866187,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MEoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxJzAlBgNVBAMTHklkZW5UcnVzdCBDb21tZXJjaWFsIFJvb3QgQ0EgMQ==",
+      "serialNumber": "QAGPK6zlV7rhg+Zdfhm+yw==",
+      "id": "5b70468c-9537-4cf7-b6cc-655781e4958b",
+      "last_modified": 1717704918914
+    },
+    {
+      "schema": 1717606866647,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
+      "serialNumber": "eSmbhHLMt1IRJtmqS3w+Hg==",
+      "id": "276d5823-5f40-4a75-ba0b-2fe35144eafc",
+      "last_modified": 1717704918911
+    },
+    {
+      "schema": 1717606865913,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MEcxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxJDAiBgNVBAMTG1RydXN0SUQgRW50ZXJwcmlzZSBUTFMgQ0EgMw==",
+      "serialNumber": "QAGPK2OnXRav9TdQ+n+NOQ==",
+      "id": "33e13515-5564-40dd-89c9-70fd43f65f31",
+      "last_modified": 1717704918907
+    },
+    {
+      "schema": 1717606866552,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9WYWRpcyBSb290IENBIDI=",
+      "serialNumber": "A1/hN80FUeTB8bAL66Wu5T+VJzQ=",
+      "id": "ab2cbd12-8f84-486f-a998-29898f0ddb93",
+      "last_modified": 1717704918903
+    },
+    {
+      "schema": 1717606866104,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MDQxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25h",
+      "serialNumber": "Hk9yv7+W0/YZwdKqJa5SuM6j9sg=",
+      "id": "f80248d3-fdfe-4d00-ba1d-063c92184da8",
+      "last_modified": 1717704918900
+    },
+    {
+      "schema": 1717606866008,
+      "details": {
+        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900843",
+        "who": "",
+        "why": "",
+        "name": "",
+        "created": ""
+      },
+      "enabled": false,
+      "issuerName": "MFoxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMDgxMDAwMzYxGTAXBgNVBAMMEENlcnRpZ25hIFJvb3QgQ0E=",
+      "serialNumber": "Vpa/MHpWy1YxUNIl27d+tZ1sX5k=",
+      "id": "09f714f1-6ae1-4253-bcad-a8417e610ebd",
+      "last_modified": 1717704918896
+    },
+    {
       "schema": 1709917272661,
       "details": {
         "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1884400",
@@ -24121,5 +24316,5 @@
       "last_modified": 1480349158647
     }
   ],
-  "timestamp": 1710189695302
+  "timestamp": 1717704918940
 }
diff --git a/sourcestamp.txt b/sourcestamp.txt
index ce93c585e0..4faddd3dc2 100644
--- a/sourcestamp.txt
+++ b/sourcestamp.txt
@@ -1,2 +1,2 @@
-20240606181944
-https://hg.mozilla.org/releases/mozilla-release/rev/cfd3e02d8411b3a938cda7242dcf044cf03c03d1
+20240618110440
+https://hg.mozilla.org/releases/mozilla-release/rev/b8d39a885c8155af6a83ad631f71108ded7fb7af
diff --git a/taskcluster/gecko_taskgraph/transforms/geckodriver_signing.py b/taskcluster/gecko_taskgraph/transforms/geckodriver_signing.py
index 95b8d3dd54..25f861e662 100644
--- a/taskcluster/gecko_taskgraph/transforms/geckodriver_signing.py
+++ b/taskcluster/gecko_taskgraph/transforms/geckodriver_signing.py
@@ -121,7 +121,7 @@ def make_signing_description(config, jobs):
 
 def _craft_upstream_artifacts(dep_job, dependency_kind, build_platform):
     if build_platform.startswith("win"):
-        signing_format = "autograph_authenticode_sha2"
+        signing_format = "autograph_authenticode_202404"
     elif build_platform.startswith("linux"):
         signing_format = "autograph_gpg"
     elif build_platform.startswith("macosx"):
diff --git a/taskcluster/gecko_taskgraph/transforms/openh264_signing.py b/taskcluster/gecko_taskgraph/transforms/openh264_signing.py
index 00a55dad41..74aebbd90b 100644
--- a/taskcluster/gecko_taskgraph/transforms/openh264_signing.py
+++ b/taskcluster/gecko_taskgraph/transforms/openh264_signing.py
@@ -81,7 +81,7 @@ def make_signing_description(config, jobs):
         }
 
         if "win" in build_platform:
-            upstream_artifact["formats"] = ["autograph_authenticode_sha2"]
+            upstream_artifact["formats"] = ["autograph_authenticode_202404"]
         elif "mac" in build_platform:
             upstream_artifact["formats"] = ["mac_single_file"]
             upstream_artifact["singleFileGlobs"] = ["libgmpopenh264.dylib"]
diff --git a/taskcluster/gecko_taskgraph/transforms/repackage_signing.py b/taskcluster/gecko_taskgraph/transforms/repackage_signing.py
index 66c1f87d70..d4106efb29 100644
--- a/taskcluster/gecko_taskgraph/transforms/repackage_signing.py
+++ b/taskcluster/gecko_taskgraph/transforms/repackage_signing.py
@@ -29,10 +29,10 @@ repackage_signing_description_schema = Schema(
 )
 
 SIGNING_FORMATS = {
-    "target.installer.exe": ["autograph_authenticode_sha2_stub"],
-    "target.stub-installer.exe": ["autograph_authenticode_sha2_stub"],
-    "target.installer.msi": ["autograph_authenticode_sha2"],
-    "target.installer.msix": ["autograph_authenticode_sha2"],
+    "target.installer.exe": ["autograph_authenticode_202404_stub"],
+    "target.stub-installer.exe": ["autograph_authenticode_202404_stub"],
+    "target.installer.msi": ["autograph_authenticode_202404"],
+    "target.installer.msix": ["autograph_authenticode_202404"],
 }
 
 transforms = TransformSequence()
diff --git a/taskcluster/gecko_taskgraph/transforms/repackage_signing_partner.py b/taskcluster/gecko_taskgraph/transforms/repackage_signing_partner.py
index e3940fd846..5f7c893e92 100644
--- a/taskcluster/gecko_taskgraph/transforms/repackage_signing_partner.py
+++ b/taskcluster/gecko_taskgraph/transforms/repackage_signing_partner.py
@@ -93,7 +93,7 @@ def make_repackage_signing_description(config, jobs):
                     "paths": [
                         get_artifact_path(dep_job, f"{repack_id}/target.installer.exe"),
                     ],
-                    "formats": ["autograph_authenticode_sha2", "autograph_gpg"],
+                    "formats": ["autograph_authenticode_202404", "autograph_gpg"],
                 }
             ]
 
@@ -113,7 +113,7 @@ def make_repackage_signing_description(config, jobs):
                                 f"{repack_id}/target.stub-installer.exe",
                             ),
                         ],
-                        "formats": ["autograph_authenticode_sha2", "autograph_gpg"],
+                        "formats": ["autograph_authenticode_202404", "autograph_gpg"],
                     }
                 )
         elif "mac" in build_platform:
diff --git a/taskcluster/gecko_taskgraph/util/signed_artifacts.py b/taskcluster/gecko_taskgraph/util/signed_artifacts.py
index 61dad14abf..302a2e09f7 100644
--- a/taskcluster/gecko_taskgraph/util/signed_artifacts.py
+++ b/taskcluster/gecko_taskgraph/util/signed_artifacts.py
@@ -98,14 +98,14 @@ def generate_specifications_of_artifacts_to_sign(
                 "artifacts": [
                     get_artifact_path(job, "{locale}/setup.exe"),
                 ],
-                "formats": ["autograph_authenticode_sha2"],
+                "formats": ["autograph_authenticode_202404"],
             },
             {
                 "artifacts": [
                     get_artifact_path(job, "{locale}/target.zip"),
                 ],
                 "formats": [
-                    "autograph_authenticode_sha2",
+                    "autograph_authenticode_202404",
                     "autograph_widevine",
                     "autograph_omnija",
                 ],
diff --git a/taskcluster/kinds/repackage-msix/kind.yml b/taskcluster/kinds/repackage-msix/kind.yml
index 96ff07c77c..2b5f682ceb 100644
--- a/taskcluster/kinds/repackage-msix/kind.yml
+++ b/taskcluster/kinds/repackage-msix/kind.yml
@@ -101,8 +101,8 @@ jobs:
                                 # level 3 repositories, some build types are expected to
                                 # be signed with our fake certificate.
                                 by-build-platform:
-                                    .*-shippable: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=Mountain View, S=California, C=US"
-                                    .*-devedition: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=Mountain View, S=California, C=US"
+                                    .*-shippable: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=San Francisco, S=California, C=US"
+                                    .*-devedition: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=San Francisco, S=California, C=US"
                                     default: "CN=Mozilla Fake SPC"
             publisher-display-name:
                 by-package-format:
diff --git a/taskcluster/kinds/repackage-shippable-l10n-msix/kind.yml b/taskcluster/kinds/repackage-shippable-l10n-msix/kind.yml
index 021896a7ad..8c7cff523b 100644
--- a/taskcluster/kinds/repackage-shippable-l10n-msix/kind.yml
+++ b/taskcluster/kinds/repackage-shippable-l10n-msix/kind.yml
@@ -102,8 +102,8 @@ jobs:
                                 # level 3 repositories, some build types are expected to
                                 # be signed with our fake certificate.
                                 by-build-platform:
-                                    .*-shippable: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=Mountain View, S=California, C=US"
-                                    .*-devedition: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=Mountain View, S=California, C=US"
+                                    .*-shippable: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=San Francisco, S=California, C=US"
+                                    .*-devedition: "CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=San Francisco, S=California, C=US"
                                     default: "CN=Mozilla Fake SPC"
             publisher-display-name:
                 by-package-format:
diff --git a/testing/web-platform/meta/cookies/attributes/attributes-ctl.sub.html.ini b/testing/web-platform/meta/cookies/attributes/attributes-ctl.sub.html.ini
index 257448fa2e..75fcc6a22d 100644
--- a/testing/web-platform/meta/cookies/attributes/attributes-ctl.sub.html.ini
+++ b/testing/web-platform/meta/cookies/attributes/attributes-ctl.sub.html.ini
@@ -2,9 +2,21 @@
   [Cookie with %x9 after Secure attribute is handled correctly.]
     expected: FAIL
 
+  [Cookie with %xa after Domain attribute value is handled correctly.]
+    expected: FAIL
+
+  [Cookie with %xa after Path attribute value is handled correctly.]
+    expected: FAIL
+
   [Cookie with %xa in Max-Age attribute value is handled correctly.]
     expected: FAIL
 
+  [Cookie with %xa after Max-Age attribute value is handled correctly.]
+    expected: FAIL
+
+  [Cookie with %xa after Expires attribute value is handled correctly.]
+    expected: FAIL
+
   [Cookie with %xa in Secure attribute is handled correctly.]
     expected: FAIL
 
@@ -14,9 +26,21 @@
   [Cookie with %xa in SameSite attribute value is handled correctly.]
     expected: FAIL
 
+  [Cookie with %xd after Domain attribute value is handled correctly.]
+    expected: FAIL
+
+  [Cookie with %xd after Path attribute value is handled correctly.]
+    expected: FAIL
+
   [Cookie with %xd in Max-Age attribute value is handled correctly.]
     expected: FAIL
 
+  [Cookie with %xd after Max-Age attribute value is handled correctly.]
+    expected: FAIL
+
+  [Cookie with %xd after Expires attribute value is handled correctly.]
+    expected: FAIL
+
   [Cookie with %xd in Secure attribute is handled correctly.]
     expected: FAIL
 
@@ -25,3 +49,9 @@
 
   [Cookie with %xd in SameSite attribute value is handled correctly.]
     expected: FAIL
+
+  [Cookie with %xa after SameSite attribute value is handled correctly.]
+    expected: FAIL
+
+  [Cookie with %xd after SameSite attribute value is handled correctly.]
+    expected: FAIL
diff --git a/toolkit/components/glean/ipc/FOGIPC.cpp b/toolkit/components/glean/ipc/FOGIPC.cpp
index e44cf3e863..4ce009e4fa 100644
--- a/toolkit/components/glean/ipc/FOGIPC.cpp
+++ b/toolkit/components/glean/ipc/FOGIPC.cpp
@@ -37,6 +37,10 @@
 #include "nsTArray.h"
 #include "nsThreadUtils.h"
 
+#if defined(__APPLE__) && defined(__aarch64__)
+#  define HAS_PROCESS_ENERGY
+#endif
+
 using mozilla::dom::ContentParent;
 using mozilla::gfx::GPUChild;
 using mozilla::gfx::GPUProcessManager;
@@ -76,6 +80,29 @@ struct ProcessingTimeMarker {
   }
 };
 
+#ifdef HAS_PROCESS_ENERGY
+struct ProcessEnergyMarker {
+  static constexpr Span<const char> MarkerTypeName() {
+    return MakeStringSpan("ProcessEnergy");
+  }
+  static void StreamJSONMarkerData(baseprofiler::SpliceableJSONWriter& aWriter,
+                                   int64_t aUWh,
+                                   const ProfilerString8View& aType) {
+    aWriter.IntProperty("energy", aUWh);
+    aWriter.StringProperty("label", aType);
+  }
+  static MarkerSchema MarkerTypeDisplay() {
+    using MS = MarkerSchema;
+    MS schema{MS::Location::MarkerChart, MS::Location::MarkerTable};
+    schema.AddKeyLabelFormat("energy", "Energy (µWh)", MS::Format::Integer);
+    schema.SetTooltipLabel("{marker.name} - {marker.data.label}");
+    schema.SetTableLabel(
+        "{marker.name} - {marker.data.label}: {marker.data.energy}µWh");
+    return schema;
+  }
+};
+#endif
+
 }  // namespace geckoprofiler::markers
 
 namespace mozilla::glean {
@@ -248,8 +275,26 @@ void GetTrackerType(nsAutoCString& aTrackerType) {
   }
 }
 
+#ifdef HAS_PROCESS_ENERGY
+static int64_t GetTaskEnergy() {
+  task_power_info_v2_data_t task_power_info;
+  mach_msg_type_number_t count = TASK_POWER_INFO_V2_COUNT;
+  kern_return_t kr = task_info(mach_task_self(), TASK_POWER_INFO_V2,
+                               (task_info_t)&task_power_info, &count);
+  if (kr != KERN_SUCCESS) {
+    return 0;
+  }
+
+  // task_energy is in nanojoules. We want microwatt-hours.
+  return task_power_info.task_energy / 3.6 / 1e6;
+}
+#endif
+
 void RecordPowerMetrics() {
   static uint64_t previousCpuTime = 0, previousGpuTime = 0;
+#ifdef HAS_PROCESS_ENERGY
+  static int64_t previousProcessEnergy = 0;
+#endif
 
   uint64_t cpuTime, newCpuTime = 0;
   if (NS_SUCCEEDED(GetCpuTimeSinceProcessStartInMs(&cpuTime)) &&
@@ -265,7 +310,16 @@ void RecordPowerMetrics() {
     newGpuTime = gpuTime - previousGpuTime;
   }
 
-  if (!newCpuTime && !newGpuTime) {
+#ifdef HAS_PROCESS_ENERGY
+  int64_t processEnergy = GetTaskEnergy();
+  int64_t newProcessEnergy = processEnergy - previousProcessEnergy;
+#endif
+
+  if (!newCpuTime && !newGpuTime
+#ifdef HAS_PROCESS_ENERGY
+      && newProcessEnergy <= 0
+#endif
+  ) {
     // Nothing to record.
     return;
   }
@@ -358,6 +412,15 @@ void RecordPowerMetrics() {
     previousGpuTime += newGpuTime;
   }
 
+#ifdef HAS_PROCESS_ENERGY
+  if (newProcessEnergy) {
+    power::energy_per_process_type.Get(type).Add(newProcessEnergy);
+    PROFILER_MARKER("Process Energy", OTHER, {}, ProcessEnergyMarker,
+                    newProcessEnergy, type);
+    previousProcessEnergy += newProcessEnergy;
+  }
+#endif
+
   profiler_record_wakeup_count(type);
 }
 
diff --git a/toolkit/components/processtools/metrics.yaml b/toolkit/components/processtools/metrics.yaml
index 6efbd22fa5..1d6e6bf133 100644
--- a/toolkit/components/processtools/metrics.yaml
+++ b/toolkit/components/processtools/metrics.yaml
@@ -112,6 +112,22 @@ power:
     expires: never
     telemetry_mirror: POWER_GPU_TIME_BOGUS_VALUES
 
+  energy_per_process_type:
+    type: labeled_counter
+    description: >
+      How much energy (in µWh) has been used, broken down by process type.
+      Only available on Apple Silicon.
+    bugs:
+      - https://bugzilla.mozilla.org/show_bug.cgi?id=1898057
+    data_reviews:
+      - https://bugzilla.mozilla.org/show_bug.cgi?id=1898057
+    data_sensitivity:
+      - technical
+    notification_emails:
+      - florian@mozilla.com
+    expires: never
+    labels: *per_process_type_labels
+
   wakeups_per_process_type:
     type: labeled_counter
     description: >
diff --git a/toolkit/moz.configure b/toolkit/moz.configure
index 6ad16dc1b7..7282b80d81 100644
--- a/toolkit/moz.configure
+++ b/toolkit/moz.configure
@@ -3353,7 +3353,7 @@ with only_when(compile_environment):
     set_config("MOZ_TREE_PIXMAN", True, when=in_tree_pixman)
     set_define("MOZ_TREE_PIXMAN", True, when=in_tree_pixman)
 
-    pkg_check_modules("MOZ_PIXMAN", "pixman-1 >= 0.36.0", when="--enable-system-pixman")
+    pkg_check_modules("MOZ_PIXMAN", "pixman-1 >= 0.40.0", when="--enable-system-pixman")
     # Set MOZ_PIXMAN_CFLAGS to an explicit empty value when --enable-system-pixman is *not* used,
     # for layout/style/extra-bindgen-flags
     set_config("MOZ_PIXMAN_CFLAGS", [], when=in_tree_pixman)