From 546d7b01b474332165fa3b942282c8b0757237ae Mon Sep 17 00:00:00 2001
From: Solomon Botchway <solomonbotchway7@gmail.com>
Date: Wed, 4 Nov 2026 12:40:30 +0000
Subject: [PATCH] fix(server): preview browser picks up Chrome 157 security
 fixes

Pin chrome-headless-shell 157.0.8103.38, the current Chrome for Testing Stable, for all six platforms. It carries the security fixes in the Nov 3 Chrome 157 stable promotion (7 Critical, 50+ High), which 156.0.8078.80 lacks.
---
 apps/server/src/preview/PreviewBrowser.ts | 26 +++++++++++------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/apps/server/src/preview/PreviewBrowser.ts b/apps/server/src/preview/PreviewBrowser.ts
index a93c06e8003c5..50ba7b91c56fa 100644
--- a/apps/server/src/preview/PreviewBrowser.ts
+++ b/apps/server/src/preview/PreviewBrowser.ts
@@ -25,31 +25,31 @@ import { openZipArchive } from "../zipArchive.ts";
 // https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json
 // Never pin below 156.0.8078.70: the shell has no CRLSet and older SPKI blocklists trust
 // compromised eMudhra intermediates (crrev.com/c/8627687).
-const VERSION = "156.0.8078.80";
+const VERSION = "157.0.8103.38";
 const ARCHIVES = {
   linux64: {
-    bytes: 126_922_702,
-    sha256: "547dcd374e02961bf998f6046a267644f8502225c36bb78ca307dab32a0b3eb4",
+    bytes: 128_168_542,
+    sha256: "deafffa74660b34853a4119c361fd427ac8c9fcb62db51ddb8a797cd83a4ba2d",
   },
   "linux-arm64": {
-    bytes: 126_679_292,
-    sha256: "5bb6a00a4285c13303d3f72c5afdb70f144ea7a93eed462365a52b69631c9607",
+    bytes: 128_171_139,
+    sha256: "b9b910a57b2a15eb3e55000a2339f93a973934a413ebfc6e585a50ec6c42fd6c",
   },
   "mac-arm64": {
-    bytes: 103_982_159,
-    sha256: "ea615baa2e9caf0d02d1898a6562b5f8fa9c35239707dae0f592178df5b986ac",
+    bytes: 104_773_711,
+    sha256: "e6a6b13551aa12f951d0891d79282606b13742837c8fa0505e1272bae116ce82",
   },
   "mac-x64": {
-    bytes: 109_493_298,
-    sha256: "535d417d9034cbd11e7dacd1a71aa3d6e1b525e6d5dcd2671eb2532f01481228",
+    bytes: 110_442_262,
+    sha256: "79821745d0a72d2ba752d981284ed0a9e6fa320dad133596941a17dba6186de3",
   },
   win32: {
-    bytes: 119_036_038,
-    sha256: "8d7472c5c60215a24c42e31d0e9567f1fbf41365e46c8d36c59b2a8b8b2b3a65",
+    bytes: 120_390_416,
+    sha256: "35e0d45c0136448f7b587f6fb7195a0686127a4dfdc23ef3b0e04b5e9ffe16cd",
   },
   win64: {
-    bytes: 125_772_546,
-    sha256: "10a77466005e7f64e00f1a75fd1ea81f4a38a60093c65fea6895843b26e60a9a",
+    bytes: 126_513_060,
+    sha256: "1ff4540855478ba0848e03f1ef8d455f77d058b38285df91bc34273788a73446",
   },
 } as const;