You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(server): preview browser downloads Chrome 157.0.8103.78 with its security fixes - #34962
Moves the pinned Chrome for Testing headless shell used by the server preview browser from 157.0.8103.38 to 157.0.8103.78, picking up that release's security fixes, and updates the byte size and SHA-256 pin for each of the six platform archives (linux64, linux-arm64, mac-arm64, mac-x64, win32, win64). Download, verification and install logic are unchanged. Every new pin was checked by downloading each archive from storage.googleapis.com/chrome-for-testing-public/157.0.8103.78: all six byte counts and SHA-256 hashes match exactly. The linux64 archive unzips and its binary reports 'Google Chrome for Testing 157.0.8103.78'. The author's commit is kept as-is, with a clean merge of origin/main on top; the diff against main is still only these 13 lines in PreviewBrowser.ts.
Not executed during screening. Start a main build with isolated T3 home state and no cached preview browser, connect the web client, create a thread, and select Browser in its right panel. Wait for installation, then inspect the installed chrome-headless-shell version directory or run that binary with --version; main should report 157.0.8103.38. Repeat with this PR using separate isolated state; it should install and report 157.0.8103.78.
Evidence
Fresh isolated state and empty preview-browser cache on each commit. Create a replay thread, open its right panel, select Browser, wait for installation, and load a local page displaying the installed chrome-headless-shell --version output. Linux x64 web client, 1280×800, light theme; browser sandbox disabled equally on both sides for this VM.
Scenario source. Base failed the version check with 157.0.8103.38; head passed with 157.0.8103.78. Both captures and recordings were inspected.
Not shown:
Downloads on macOS, Windows, and other architectures were not exercised; this proof covers Linux x64.
The underlying Chrome security vulnerabilities were not exploited; this proof verifies installation and successful use of the patched browser version.
Tests
vp test run apps/server/src/preview/PreviewBrowser.test.ts: 8/8 passed. vp run check:changed: format, lint, knip, typecheck (3 packages) and tests (2 files) all passed. Streamed sha256sum and byte count of all six 157.0.8103.78 archives: all match the pins. Unzipped linux64 chrome-headless-shell --version: 'Google Chrome for Testing 157.0.8103.78'.
Who did the work
Written by Claude Opus 5.5, in Claude Code
Reviewed by GPT-6.1 Sol, in Codex, and by Claude Opus 5.5, each on its own
Proof captured by GPT-6.1 Sol and checked by Claude Opus 5.5
…security fixes
The server's preview browser was pinned to Chrome for Testing 157.0.8103.38,
which lacks the security fixes in 157.0.8103.50 (including an exploited CVE)
and 157.0.8103.78. Bump the pin to the current Stable, 157.0.8103.78, with
sizes and SHA-256s computed from each chrome-headless-shell archive.
Fixes#34920
AI-assisted; verified with the tests and tools listed above.
Macroscope's review found this PR approvable — Updates the preview browser to a newer Chrome patch release and refreshes its platform archive metadata. Existing integrity checks and on-demand installation behavior remain unchanged, keeping the update's exposure limited.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
Walkthrough
The server’s pinned Chrome for Testing headless-shell version changes from 157.0.8103.38 to 157.0.8103.78. Expected archive sizes and SHA-256 digests are updated for Linux, macOS, and Windows.
Changes: Preview browser pin
Layer / File(s)
Summary
Update pinned release and archive metadata apps/server/src/preview/PreviewBrowser.ts
The pinned version and expected sizes and SHA-256 digests change for the six platform archives.
pingdotgg/t3code#30820: Pins Chrome headless-shell version 157.0.8103.38 and defines archive metadata for the same platforms.
pingdotgg/t3code#26684: Changes the browser archive definition in PreviewBrowser.ts from headless-shell to full Chrome.
pingdotgg/t3code#24542: Updates the headless-shell pin and archive metadata in PreviewBrowser.ts.
Suggested labels:bugfix
Suggested reviewers:snnbotchway
Merge Risk: Minimal · up to 7b7ad
This updates the preview browser to a newer Chrome security release. The risk is low, and a wrong checksum would block the download rather than install an unverified binary.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title states the main change: the server preview browser pin moves to Chrome for Testing 157.0.8103.78 to pick up its security fixes. The raw summary confirms the version bump and the updated size…
Linked Issues check
Directly linked issue #34920 reports that the server preview browser is pinned to Chrome for Testing 157.0.8103.38 and misses the 157.0.8103.50 and 157.0.8103.78 security fixes. The concrete coding re…
Out of Scope Changes check
The whole-PR diff against the merge base changes only apps/server/src/preview/PreviewBrowser.ts. The changes are the VERSION constant and the per-platform byte and sha256 values, with a +13/-13 line c…
Description check
The description follows the template closely. It gives a clear problem statement (the pinned Chrome for Testing headless shell needs the 157.0.8103.78 security release, with the issue #34920 link), a …
Full details: Title check
Explanation
The title states the main change: the server preview browser pin moves to Chrome for Testing 157.0.8103.78 to pick up its security fixes. The raw summary confirms the version bump and the updated sizes and hashes. The title follows the conventional commit format from the template. Its phrasing is long, but it stays specific and accurate.
Full details: Linked Issues check
Explanation
Directly linked issue #34920 reports that the server preview browser is pinned to Chrome for Testing 157.0.8103.38 and misses the 157.0.8103.50 and 157.0.8103.78 security fixes. The concrete coding requirement is to move the pin forward. The diff to apps/server/src/preview/PreviewBrowser.ts sets VERSION to "157.0.8103.78" and replaces the bytes and sha256 values for all six archives (linux64, linux-arm64, mac-arm64, mac-x64, win32, win64). The download, size, and hash check logic is unchanged. The issue also asks for ongoing update automation or a stated update policy. It presents these as suggestions ("Could the bump be automated?", "Failing that, a stated policy would help"), not as acceptance criteria. The PR description excludes automation as a separate follow-up. The SHA-256 and byte values were not recomputed during this review. Their correctness rests on the PR author's reported verification, which is not independently confirmed here.
Full details: Out of Scope Changes check
Explanation
The whole-PR diff against the merge base changes only apps/server/src/preview/PreviewBrowser.ts. The changes are the VERSION constant and the per-platform byte and sha256 values, with a +13/-13 line count. Each change directly supports the pin bump from #34920. No unrelated code, configuration, workflow, or dependency changes appear in the reviewed evidence. The automated pin-update workflow suggested in the issue is not included, and the PR description states it is out of scope.
Full details: Description check
Explanation
The description follows the template closely. It gives a clear problem statement (the pinned Chrome for Testing headless shell needs the 157.0.8103.78 security release, with the issue #34920 link), a precise change (version and six byte-size and SHA-256 pins updated, with download, verify, and install logic unchanged), and a scope link to the issue. Verification is thorough: pin checks against the official archives, a Linux x64 binary version check, 8/8 unit tests, the changed-file check suite, and before/after evidence. Reproduction steps on main are included. The Problem section is brief and the Scope section does not explicitly justify the change as a bug fix beyond the issue link, but it does link the issue that describes the need. Two gaps remain: the macOS, Windows, and other architecture downloads were not exercised, which the author discloses, and the 'Who did the work' section lists model names that the template's agent attribution line asks for, so that part is complete. Overall the description is mostly complete and substantive.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
size:S10-29 changed lines (additions + deletions).vouch:trustedAuthor is trusted by repo permissions or the VOUCHED list.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
vouch:trusted
juliusmarminge
added
the
takeover:in-progress
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
Moves the pinned Chrome for Testing headless shell used by the server preview browser from 157.0.8103.38 to 157.0.8103.78, picking up that release's security fixes, and updates the byte size and SHA-256 pin for each of the six platform archives (linux64, linux-arm64, mac-arm64, mac-x64, win32, win64). Download, verification and install logic are unchanged. Every new pin was checked by downloading each archive from storage.googleapis.com/chrome-for-testing-public/157.0.8103.78: all six byte counts and SHA-256 hashes match exactly. The linux64 archive unzips and its binary reports 'Google Chrome for Testing 157.0.8103.78'. The author's commit is kept as-is, with a clean merge of origin/main on top; the diff against main is still only these 13 lines in PreviewBrowser.ts.
Fixes #34920
Reproduction on main
Not executed during screening. Start a main build with isolated T3 home state and no cached preview browser, connect the web client, create a thread, and select Browser in its right panel. Wait for installation, then inspect the installed chrome-headless-shell version directory or run that binary with --version; main should report 157.0.8103.38. Repeat with this PR using separate isolated state; it should install and report 157.0.8103.78.
Evidence
Fresh isolated state and empty preview-browser cache on each commit. Create a replay thread, open its right panel, select Browser, wait for installation, and load a local page displaying the installed chrome-headless-shell --version output. Linux x64 web client, 1280×800, light theme; browser sandbox disabled equally on both sides for this VM.
Scenario source. Base failed the version check with 157.0.8103.38; head passed with 157.0.8103.78. Both captures and recordings were inspected.
Not shown:
Tests
vp test run apps/server/src/preview/PreviewBrowser.test.ts: 8/8 passed. vp run check:changed: format, lint, knip, typecheck (3 packages) and tests (2 files) all passed. Streamed sha256sum and byte count of all six 157.0.8103.78 archives: all match the pins. Unzipped linux64 chrome-headless-shell --version: 'Google Chrome for Testing 157.0.8103.78'.
Who did the work
Run by the t3code factory in T3 Code.