[rpms/firefox] f44: Update to 165.0.1

[Martin Stransky <stransky@redhat.com>]

A new commit has been pushed.

Repo   : rpms/firefox
Branch : f44
Commit : c7b1463f3d18be488b2c3a55f828ed8e65265046
Author : Martin Stransky <stransky@redhat.com>
Date   : 2026-09-23T10:00:17+02:00
Stats  : +936/-108 in 6 file(s)
URL    : https://src.fedoraproject.org/rpms/firefox/c/c7b1463f3d18be488b2c3a55f828ed8e65265046?branch=f44

Log:
Update to 165.0.1

---
diff --git a/.gitignore b/.gitignore
index abaef23..5d02f87 100644
--- a/.gitignore
+++ b/.gitignore
@@ -799,3 +799,5 @@ firefox-3.6.4.source.tar.bz2
 /firefox-155.0.1.source.tar.xz
 /firefox-156.0.source.tar.xz
 /firefox-langpacks-156.0-20260910.tar.xz
+/firefox-156.0.1.source.tar.xz
+/firefox-langpacks-156.0.1-20260923.tar.xz

diff --git a/D326840.1789732703.diff b/D326840.1789732703.diff
deleted file mode 100644
index 499c25d..0000000
--- a/D326840.1789732703.diff
+++ /dev/null
@@ -1,100 +0,0 @@
-diff --git a/widget/gtk/nsWindow.h b/widget/gtk/nsWindow.h
---- a/widget/gtk/nsWindow.h
-+++ b/widget/gtk/nsWindow.h
-@@ -199,12 +199,10 @@
-   bool IsEnabled() const override;
- 
-   nsSizeMode GetSizeMode() const { return mSizeMode; }
-   nsSizeMode SizeMode() override { return mSizeMode; }
-   void SetSizeMode(nsSizeMode aMode) override;
--  void GetWorkspaceID(nsAString& workspaceID) override;
--  void MoveToWorkspace(const nsAString& workspaceID) override;
-   void Enable(bool aState) override;
-   void SetFocus(Raise, mozilla::dom::CallerType aCallerType) override;
-   LayoutDeviceIntRect GetBounds() override;
-   LayoutDeviceIntRect GetScreenBounds() override;
-   DesktopIntRect GetScreenBoundsUnscaled();
-diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
---- a/widget/gtk/nsWindow.cpp
-+++ b/widget/gtk/nsWindow.cpp
-@@ -1202,18 +1202,10 @@
- 
-   const auto& desktop = GetDesktopEnvironmentIdentifier();
-   return desktop.EqualsLiteral("bspwm") || desktop.EqualsLiteral("i3");
- }
- 
--void nsWindow::GetWorkspaceID(nsAString& workspaceID) {
--  workspaceID.Truncate();
--}
--
--void nsWindow::MoveToWorkspace(const nsAString& workspaceIDStr) {
--  LOG("  MoveToWorkspace disabled, quit");
--}
--
- void nsWindow::SetUserTimeAndStartupTokenForActivatedWindow() {
-   nsGTKToolkit* toolkit = nsGTKToolkit::GetToolkit();
-   if (!toolkit) {
-     return;
-   }
-diff --git a/widget/gtk/nsWindowWayland.h b/widget/gtk/nsWindowWayland.h
---- a/widget/gtk/nsWindowWayland.h
-+++ b/widget/gtk/nsWindowWayland.h
-@@ -14,12 +14,12 @@
-   nsWindowWayland();
- 
-   nsWindowWayland* AsWayland() override { return this; }
-   nsWindow* GetEffectiveParent() const;
- 
--  void GetWorkspaceID(nsAString& workspaceID) override;
--  void MoveToWorkspace(const nsAString& workspaceIDStr) override;
-+  void GetWorkspaceID(nsAString& aWorkspaceID) override;
-+  void MoveToWorkspace(const nsAString& aWorkspaceIDStr) override;
-   void RestoreXdgToplevel();
- 
-   // Use xdg-activation protocol to transfer focus from gFocusWindow.
-   void TransferFocusTo();
-   void FocusWaylandWindow(const char* aTokenID);
-diff --git a/widget/gtk/nsWindowWayland.cpp b/widget/gtk/nsWindowWayland.cpp
---- a/widget/gtk/nsWindowWayland.cpp
-+++ b/widget/gtk/nsWindowWayland.cpp
-@@ -116,15 +116,19 @@
-   LOG("nsWindowWayland::CreateRestoreSession() ID %s restore %d token %p",
-       mWorkspaceID.get(), aRestoreWindow, mSessionRestoreToken);
-   return !!mSessionRestoreToken;
- }
- 
--void nsWindowWayland::GetWorkspaceID(nsAString& workspaceID) {
-+void nsWindowWayland::GetWorkspaceID(nsAString& aWorkspaceID) {
-+  if (!nsAppShell::IsSessionRestoreSupported()) {
-+    aWorkspaceID.Truncate();
-+    return;
-+  }
-   if (mWorkspaceID.IsEmpty()) {
-     mWorkspaceID = GenerateWorkspaceID();
-   }
--  workspaceID = NS_ConvertUTF8toUTF16(mWorkspaceID);
-+  aWorkspaceID = NS_ConvertUTF8toUTF16(mWorkspaceID);
- 
-   LOG("nsWindowWayland::GetWorkspaceID() ID %s token %p", mWorkspaceID.get(),
-       mSessionRestoreToken);
- 
-   if (mSessionRestoreToken) {
-@@ -156,12 +160,15 @@
-     }
- #endif
-   }
- }
- 
--void nsWindowWayland::MoveToWorkspace(const nsAString& workspaceIDStr) {
--  mWorkspaceID = NS_ConvertUTF16toUTF8(workspaceIDStr);
-+void nsWindowWayland::MoveToWorkspace(const nsAString& aWorkspaceIDStr) {
-+  if (!nsAppShell::IsSessionRestoreSupported()) {
-+    return;
-+  }
-+  mWorkspaceID = NS_ConvertUTF16toUTF8(aWorkspaceIDStr);
-   LOG("nsWindowWayland::MoveToWorkspace() session ID %s "
-       "mWaitingToSessionRestore %d mNeedsShow %d",
-       mWorkspaceID.get(), mWaitingToSessionRestore, mNeedsShow);
-   if (!mWaitingToSessionRestore) {
-     return;
-

diff --git a/firefox-update.sh b/firefox-update.sh
new file mode 100755
index 0000000..de1c437
--- /dev/null
+++ b/firefox-update.sh
@@ -0,0 +1,925 @@
+#!/bin/bash
+#
+# firefox-update.sh - Update the Firefox package in Fedora rawhide to a new
+#                     upstream version.
+#
+# This is a shell implementation of the "firefox-update" skill
+# (see Update-SKILL.md). It performs the mechanical steps of the update;
+# steps which need human judgement (patch rebasing, build failure analysis)
+# stop the script with a description of what has to be done manually.
+#
+# Usage: ./firefox-update.sh <version> [options]
+#
+set -o pipefail
+
+#-----------------------------------------------------------------------------
+# Configuration / defaults
+#-----------------------------------------------------------------------------
+
+FEDORA_BASE_DIR="${FEDORA_BASE_DIR:-$PWD}"
+CHANGELOG_AUTHOR="${CHANGELOG_AUTHOR:-}"
+ARCHIVE_URL="https://archive.mozilla.org/pub/firefox/candidates"
+
+NEW_VERSION=""
+OLD_VERSION=""
+BUILD_VERSION=""
+PACKAGE_DIR=""
+LANGPACK_FILE=""
+NEW_TARBALL=""
+NSS_VERSION=""
+NSPR_VERSION=""
+OLD_NSS_VERSION=""
+OLD_NSPR_VERSION=""
+
+RESUME_FROM=1
+ASSUME_YES=0
+DROP_PATCHES=()
+DROPPED_PATCHES=()
+DO_LOCAL_BUILD=0
+DO_PUSH=0
+DO_ROLLBACK=0
+SPEC_NOTES=()
+
+#-----------------------------------------------------------------------------
+# Output helpers
+#-----------------------------------------------------------------------------
+
+if [ -t 1 ]; then
+    C_BOLD=$'\e[1m'; C_RED=$'\e[31m'; C_GREEN=$'\e[32m'
+    C_YELLOW=$'\e[33m'; C_BLUE=$'\e[34m'; C_OFF=$'\e[0m'
+else
+    C_BOLD=""; C_RED=""; C_GREEN=""; C_YELLOW=""; C_BLUE=""; C_OFF=""
+fi
+
+CURRENT_STEP=0
+
+step() {
+    CURRENT_STEP="$1"; shift
+    printf '\n%s==> Step %s: %s...%s\n' "$C_BOLD$C_BLUE" "$CURRENT_STEP" "$*" "$C_OFF"
+}
+
+ok()   { printf '%s✅ %s%s\n' "$C_GREEN" "$*" "$C_OFF"; }
+info() { printf '   %s\n' "$*"; }
+warn() { printf '%s⚠️  %s%s\n' "$C_YELLOW" "$*" "$C_OFF" >&2; }
+
+die() {
+    printf '\n%s❌ ERROR: %s%s\n' "$C_RED" "$*" "$C_OFF" >&2
+    if [ "$CURRENT_STEP" -gt 0 ]; then
+        printf '%sFix the problem and resume with: %s %s --resume %s%s\n' \
+            "$C_YELLOW" "$0" "$NEW_VERSION" "$CURRENT_STEP" "$C_OFF" >&2
+    fi
+    exit 1
+}
+
+run() {
+    printf '%s$ %s%s\n' "$C_BOLD" "$*" "$C_OFF"
+    "$@"
+}
+
+# confirm "question" [default_yes]
+confirm() {
+    local question="$1" default="${2:-n}" answer
+    if [ "$ASSUME_YES" -eq 1 ]; then
+        info "$question -> yes (--yes)"
+        return 0
+    fi
+    if [ ! -t 0 ]; then
+        info "$question -> $default (not a terminal)"
+        [ "$default" = "y" ]
+        return
+    fi
+    while true; do
+        if [ "$default" = "y" ]; then
+            read -r -p "$C_BOLD$question [Y/n] $C_OFF" answer
+            answer="${answer:-y}"
+        else
+            read -r -p "$C_BOLD$question [y/N] $C_OFF" answer
+            answer="${answer:-n}"
+        fi
+        case "${answer,,}" in
+            y|yes) return 0 ;;
+            n|no)  return 1 ;;
+            *)     echo "Please answer yes or no." ;;
+        esac
+    done
+}
+
+ask() {
+    local question="$1" answer
+    [ -t 0 ] || die "Need an answer for: $question (run interactively or pass it as an option)"
+    read -r -p "$C_BOLD$question $C_OFF" answer
+    printf '%s' "$answer"
+}
+
+# Steps below RESUME_FROM are skipped.
+skip_step() {
+    [ "$1" -lt "$RESUME_FROM" ]
+}
+
+#-----------------------------------------------------------------------------
+# Usage
+#-----------------------------------------------------------------------------
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") <version> [options]
+
+Updates the Firefox package in Fedora rawhide to <version> (e.g. 157.0).
+
+Options:
+  --resume N          Skip to step N (1-14), reading current on-disk state
+  --build buildN      Use this Mozilla candidate build instead of the latest
+  --dir PATH          Package directory (default: \$PWD if it holds firefox.spec,
+                      otherwise \$FEDORA_BASE_DIR/firefox)
+  -d, --drop-patch P  Drop a patch that is no longer needed: removes its
+                      PatchNNN: and %patch -PNNN lines from firefox.spec and
+                      deletes the file from git. P is the patch file name or
+                      its number. May be given more than once.
+  --local             Run 'fedpkg local' (step 12); takes 1-2 hours
+  --push              Push to Fedora dist-git when finished (step 14)
+  --yes               Answer yes to all questions (non-interactive)
+  --rollback          Discard the in-progress update and clean up, then exit
+  -h, --help          Show this help
+
+Environment:
+  FEDORA_BASE_DIR     Base directory holding the dist-git clones
+  CHANGELOG_AUTHOR    "Name <email>" used for the %changelog entry
+
+Steps:
+   1 Get version info          8 Upload new sources
+   2 Set up package directory  9 Check and rebase patches (manual)
+   3 Pull latest rawhide      10 Verify patches with fedpkg prep
+   4 Bump version in spec     11 Detect NSS/NSPR versions from the tarball
+   5 Get Mozilla build number 12 Local build (optional)
+   6 Download source tarball  13 Commit the update
+   7 Download langpacks       14 Summary and push
+
+The NSS and NSPR requirements are always taken from the Firefox sources in
+step 11 and written to firefox.spec - the script never asks for them.
+EOF
+}
+
+#-----------------------------------------------------------------------------
+# Argument parsing
+#-----------------------------------------------------------------------------
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --resume)   RESUME_FROM="$2"; shift 2 ;;
+        --resume=*) RESUME_FROM="${1#*=}"; shift ;;
+        --build)    BUILD_VERSION="$2"; shift 2 ;;
+        --build=*)  BUILD_VERSION="${1#*=}"; shift ;;
+        --dir)      PACKAGE_DIR="$2"; shift 2 ;;
+        --dir=*)    PACKAGE_DIR="${1#*=}"; shift ;;
+        -d|--drop-patch) DROP_PATCHES+=("$2"); shift 2 ;;
+        -d=*)            DROP_PATCHES+=("${1#*=}"); shift ;;
+        --drop-patch=*)  DROP_PATCHES+=("${1#*=}"); shift ;;
+        --local)    DO_LOCAL_BUILD=1; shift ;;
+        --push)     DO_PUSH=1; shift ;;
+        --yes|-y)   ASSUME_YES=1; shift ;;
+        --rollback) DO_ROLLBACK=1; shift ;;
+        -h|--help)  usage; exit 0 ;;
+        -*)         usage >&2; die "Unknown option: $1" ;;
+        *)
+            [ -z "$NEW_VERSION" ] || die "Unexpected argument: $1"
+            NEW_VERSION="$1"; shift ;;
+    esac
+done
+
+case "$RESUME_FROM" in
+    ''|*[!0-9]*) die "--resume needs a step number (1-14)" ;;
+esac
+[ "$RESUME_FROM" -ge 1 ] && [ "$RESUME_FROM" -le 14 ] || die "--resume must be 1-14"
+
+#-----------------------------------------------------------------------------
+# Preflight
+#-----------------------------------------------------------------------------
+
+for tool in fedpkg rpmdev-bumpspec git wget curl python3 rpmspec; do
+    command -v "$tool" >/dev/null 2>&1 || die "Required tool not found: $tool"
+done
+
+# Ensure a usable Fedora Kerberos ticket, otherwise fedpkg calls fail later on.
+check_kerberos() {
+    local principal
+    principal=$(klist -l 2>/dev/null | awk '/FEDORAPROJECT\.ORG/ {print $1; exit}')
+    if [ -n "$principal" ] && klist -s 2>/dev/null; then
+        info "Kerberos principal: $principal"
+        return 0
+    fi
+    if [ -n "$principal" ]; then
+        die "Kerberos ticket for $principal is missing or expired. Run: kinit $principal"
+    fi
+    die "No FEDORAPROJECT.ORG Kerberos ticket found. Run: kinit <username>@FEDORAPROJECT.ORG"
+}
+
+spec_get() {  # spec_get <tag-or-macro-regexp> -- first capture of the value
+    grep -m1 -oP "$1" firefox.spec 2>/dev/null
+}
+
+# drop_patch <patch-file-name | patch-number>
+# Removes the PatchNNN: declaration and the matching '%patch -PNNN' line from
+# firefox.spec, then deletes the patch file from git.
+drop_patch() {
+    local want="$1" num file
+    if [[ "$want" =~ ^[0-9]+$ ]]; then
+        num="$want"
+        file=$(grep -m1 -oP "^Patch${num}:[[:space:]]*\K\S+" firefox.spec)
+        [ -n "$file" ] || die "No 'Patch${num}:' line in firefox.spec"
+    else
+        file="$want"
+        num=$(awk -v f="$file" \
+            '$1 ~ /^Patch[0-9]*:$/ && $2 == f { sub(/^Patch/,"",$1); sub(/:$/,"",$1); print $1; exit }' \
+            firefox.spec)
+        [ -n "$num" ] || die "Patch '$file' is not referenced by firefox.spec"
+    fi
+
+    info "Dropping Patch${num}: $file"
+
+    sed -i -E "/^Patch${num}:[[:space:]]/d" firefox.spec \
+        || die "Cannot remove the Patch${num}: line"
+    grep -qE "^Patch${num}:[[:space:]]" firefox.spec \
+        && die "Patch${num}: is still in firefox.spec"
+
+    # '-P44' must not match '-P440', hence the trailing boundary.
+    if grep -qE "^%patch[[:space:]]+-P${num}([[:space:]]|$)" firefox.spec; then
+        sed -i -E "/^%patch[[:space:]]+-P${num}([[:space:]]|$)/d" firefox.spec \
+            || die "Cannot remove the '%patch -P${num}' line"
+        grep -qE "^%patch[[:space:]]+-P${num}([[:space:]]|$)" firefox.spec \
+            && die "'%patch -P${num}' is still in firefox.spec"
+    else
+        warn "No '%patch -P${num}' line found - only the declaration was removed."
+    fi
+
+    if git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
+        run git rm -f -- "$file" || die "git rm of $file failed"
+    elif [ -f "$file" ]; then
+        info "$file is not tracked by git, removing it from disk"
+        rm -f -- "$file"
+    else
+        warn "$file does not exist on disk - only firefox.spec was changed."
+    fi
+
+    DROPPED_PATCHES+=("$file (Patch${num})")
+    SPEC_NOTES+=("Dropped Patch${num}: $file")
+}
+
+#-----------------------------------------------------------------------------
+# Step 1: Get version info
+#-----------------------------------------------------------------------------
+
+# --drop-patch without a version only edits the spec and git - no update is
+# started, so no version is needed or asked for.
+DROP_ONLY=0
+if [ -z "$NEW_VERSION" ] && [ "${#DROP_PATCHES[@]}" -gt 0 ]; then
+    DROP_ONLY=1
+fi
+
+if [ -z "$NEW_VERSION" ] && [ "$DROP_ONLY" -eq 0 ]; then
+    NEW_VERSION=$(ask "What Firefox version would you like to update to? (e.g. 157.0)")
+    [ -n "$NEW_VERSION" ] || die "No version given"
+fi
+
+if [ -z "$PACKAGE_DIR" ]; then
+    if [ -f "$PWD/firefox.spec" ]; then
+        PACKAGE_DIR="$PWD"
+    else
+        PACKAGE_DIR="$FEDORA_BASE_DIR/firefox"
+    fi
+fi
+
+if [ "$DROP_ONLY" -eq 0 ]; then
+    step 1 "Preparing update to Firefox $NEW_VERSION"
+    info "Package directory: $PACKAGE_DIR"
+    ok "Target version: $NEW_VERSION"
+fi
+
+#-----------------------------------------------------------------------------
+# Step 2: Set up the package directory
+#-----------------------------------------------------------------------------
+
+if [ ! -d "$PACKAGE_DIR" ]; then
+    step 2 "Cloning the firefox package"
+    check_kerberos
+    cd "$FEDORA_BASE_DIR" || die "Cannot enter $FEDORA_BASE_DIR"
+    run fedpkg clone firefox || die "fedpkg clone firefox failed"
+    ok "Cloned firefox into $PACKAGE_DIR"
+fi
+
+cd "$PACKAGE_DIR" || die "Cannot enter $PACKAGE_DIR"
+[ -f firefox.spec ] || die "$PACKAGE_DIR does not contain firefox.spec"
+
+#-----------------------------------------------------------------------------
+# Drop-only mode: -d/--drop-patch given without a version
+#-----------------------------------------------------------------------------
+
+if [ "$DROP_ONLY" -eq 1 ]; then
+    printf '\n%s==> Dropping %d patch(es) from firefox.spec in %s%s\n' \
+        "$C_BOLD$C_BLUE" "${#DROP_PATCHES[@]}" "$PACKAGE_DIR" "$C_OFF"
+    for p in "${DROP_PATCHES[@]}"; do
+        drop_patch "$p"
+    done
+    printf '\n  Dropped patches:\n'
+    printf '    - %s\n' "${DROPPED_PATCHES[@]}"
+    printf '\n'
+    ok "firefox.spec updated and the patch files removed from git."
+    info "Review with 'git diff' and commit when you are ready."
+    exit 0
+fi
+
+#-----------------------------------------------------------------------------
+# Report the state of the working tree before touching anything
+#-----------------------------------------------------------------------------
+
+# Prints the local changes as a diff; returns 0 when there are any.
+# Untracked files are ignored on purpose - a normal run leaves downloaded
+# tarballs lying around and those are not interesting here.
+show_local_changes() {
+    git diff --quiet HEAD 2>/dev/null && return 1
+    printf '%sLocal changes in %s (branch %s):%s\n\n' \
+        "$C_BOLD$C_YELLOW" "$PACKAGE_DIR" "$(git branch --show-current)" "$C_OFF"
+    git --no-pager diff HEAD
+    printf '\n'
+    git --no-pager diff --stat HEAD | tail -1
+    return 0
+}
+
+# Destructive prompts are never auto-answered by --yes; they always need a
+# deliberate keystroke. Answering 'q' aborts the whole update.
+confirm_destructive() {
+    local question="$1" answer
+    if [ ! -t 0 ]; then
+        info "$question -> no (not a terminal)"
+        return 1
+    fi
+    while true; do
+        read -r -p "$C_BOLD$C_RED$question [y]es / [N]o / [q]uit $C_OFF" answer
+        case "${answer,,}" in
+            y|yes)  return 0 ;;
+            n|no|"") return 1 ;;
+            q|quit)
+                printf '%sAborted - the working tree is left untouched.%s\n' \
+                    "$C_YELLOW" "$C_OFF"
+                exit 0 ;;
+            *) echo "Please answer y, n or q." ;;
+        esac
+    done
+}
+
+# Offer to throw the local changes away before starting the update.
+offer_reset_local_changes() {
+    if [ "$RESUME_FROM" -gt 1 ]; then
+        warn "Resuming at step $RESUME_FROM - the changes above are probably your"
+        warn "in-progress update. Discarding them restarts the update from scratch."
+    fi
+
+    printf '\n'
+    if confirm_destructive "Discard the local changes with 'git reset --hard HEAD'?"; then
+        run git reset --hard HEAD || die "git reset --hard failed"
+        ok "Local changes discarded."
+    else
+        info "Keeping the local changes."
+    fi
+}
+
+printf '\n'
+if show_local_changes; then
+    HAVE_LOCAL_CHANGES=1
+    [ "$DO_ROLLBACK" -eq 1 ] || offer_reset_local_changes
+    # Re-check: the offer above may have reset the tree.
+    git diff --quiet HEAD 2>/dev/null && HAVE_LOCAL_CHANGES=0
+else
+    HAVE_LOCAL_CHANGES=0
+    ok "Working tree is clean."
+fi
+
+#-----------------------------------------------------------------------------
+# Rollback mode
+#-----------------------------------------------------------------------------
+
+if [ "$DO_ROLLBACK" -eq 1 ]; then
+    printf '\n%sRollback: discarding the in-progress update listed above%s\n' \
+        "$C_BOLD$C_YELLOW" "$C_OFF"
+    confirm "Reset the working tree to origin/rawhide and remove downloaded tarballs?" \
+        || die "Rollback cancelled"
+    run git checkout rawhide || die "git checkout rawhide failed"
+    run git reset --hard origin/rawhide || die "git reset failed"
+    rm -rf "firefox-$NEW_VERSION/"
+    rm -f  "firefox-$NEW_VERSION.source.tar.xz"
+    rm -f  firefox-langpacks-"$NEW_VERSION"-*.tar.xz
+    ok "Rollback complete - the working tree is clean."
+    exit 0
+fi
+
+#-----------------------------------------------------------------------------
+# Step 3: Pull latest rawhide
+#-----------------------------------------------------------------------------
+
+if ! skip_step 3; then
+    step 3 "Pulling latest rawhide"
+    if [ "$HAVE_LOCAL_CHANGES" -eq 1 ]; then
+        warn "The working tree has uncommitted changes (shown above)"
+        confirm "Continue anyway?" || die "Aborted - clean the working tree first"
+    fi
+    if git show-ref --verify --quiet refs/heads/rawhide; then
+        run git checkout rawhide || die "git checkout rawhide failed"
+    else
+        run git checkout -b rawhide origin/rawhide || die "Cannot create the rawhide branch"
+    fi
+    run git pull || die "git pull failed"
+    ok "Working tree is up to date on rawhide."
+fi
+
+#-----------------------------------------------------------------------------
+# Step 4: Bump the version in the SPEC file
+#-----------------------------------------------------------------------------
+
+OLD_NSS_VERSION=$(spec_get '^%global\s+nss_version\s+\K\S+')
+OLD_NSPR_VERSION=$(spec_get '^%global\s+nspr_version\s+\K\S+')
+
+if ! skip_step 4; then
+    step 4 "Bumping the version in firefox.spec"
+    OLD_VERSION=$(spec_get '^Version:\s*\K\S+')
+    [ -n "$OLD_VERSION" ] || die "Cannot read Version: from firefox.spec"
+    info "Current version: $OLD_VERSION"
+
+    DO_BUMP=1
+    if [ "$OLD_VERSION" = "$NEW_VERSION" ]; then
+        warn "firefox.spec is already at $NEW_VERSION"
+        if confirm "Bump it again (adds another changelog entry)?"; then
+            DO_BUMP=1
+        else
+            DO_BUMP=0
+            info "Keeping the spec version as is."
+        fi
+    fi
+
+    if [ "$DO_BUMP" -eq 1 ]; then
+        bumpspec_args=(--new "$NEW_VERSION" --comment "Update to latest upstream ($NEW_VERSION)")
+        [ -n "$CHANGELOG_AUTHOR" ] && bumpspec_args+=(--userstring "$CHANGELOG_AUTHOR")
+        run rpmdev-bumpspec "${bumpspec_args[@]}" firefox.spec \
+            || die "rpmdev-bumpspec failed"
+    fi
+
+    got_version=$(spec_get '^Version:\s*\K\S+')
+    [ "$got_version" = "$NEW_VERSION" ] \
+        || die "Version: is $got_version, expected $NEW_VERSION - fix firefox.spec manually"
+
+    got_release=$(spec_get '^Release:\s*\K\S+')
+    if [[ "$got_release" != 1* ]]; then
+        info "Release is '$got_release', resetting to 1%{?pre_tag}%{?dist}"
+        sed -i -E 's|^Release:([[:space:]]*).*|Release:\11%{?pre_tag}%{?dist}|' firefox.spec \
+            || die "Cannot reset Release:"
+    fi
+    ok "firefox.spec is at $NEW_VERSION, release $(spec_get '^Release:\s*\K\S+')."
+fi
+
+# Recover OLD_VERSION when resuming past step 4.
+if [ -z "$OLD_VERSION" ]; then
+    OLD_VERSION=$(git show HEAD:firefox.spec 2>/dev/null | grep -m1 -oP '^Version:\s*\K\S+')
+    OLD_VERSION="${OLD_VERSION:-unknown}"
+fi
+
+#-----------------------------------------------------------------------------
+# Step 5: Get the Mozilla build version
+#-----------------------------------------------------------------------------
+
+CANDIDATES_URL="$ARCHIVE_URL/$NEW_VERSION-candidates"
+
+if [ -z "$BUILD_VERSION" ]; then
+    step 5 "Looking up the latest Mozilla candidate build"
+    listing=$(curl -fsSL "$CANDIDATES_URL/") \
+        || die "Cannot list $CANDIDATES_URL/ - is $NEW_VERSION released yet?"
+    BUILD_VERSION=$(grep -oE 'build[0-9]+/' <<<"$listing" | tr -d '/' | sort -u -V | tail -1)
+    [ -n "$BUILD_VERSION" ] || die "No buildN directory found in $CANDIDATES_URL/"
+    ok "Latest candidate build: $BUILD_VERSION"
+else
+    info "Using candidate build: $BUILD_VERSION (from --build)"
+fi
+
+BUILD_URL="$CANDIDATES_URL/$BUILD_VERSION"
+# The source tarball and its .asc live in the source/ subdirectory, the
+# langpack XPIs do not.
+SOURCE_URL="$BUILD_URL/source"
+
+#-----------------------------------------------------------------------------
+# Step 6: Download the Firefox source tarball
+#-----------------------------------------------------------------------------
+
+NEW_TARBALL="firefox-$NEW_VERSION.source.tar.xz"
+
+# Checks $NEW_TARBALL against the detached signature $NEW_TARBALL.asc.
+#   0 = good signature, 1 = bad signature, 2 = cannot tell (no gpg / no key)
+verify_tarball_signature() {
+    command -v gpg >/dev/null 2>&1 || return 2
+    [ -s "$NEW_TARBALL.asc" ] || return 2
+    local out key
+    out=$(gpg --verify "$NEW_TARBALL.asc" "$NEW_TARBALL" 2>&1)
+    if grep -q '^gpg: Good signature' <<<"$out"; then
+        return 0
+    fi
+    if grep -qE "No public key|Can't check signature" <<<"$out"; then
+        # Mozilla rotates its signing key, so take the key id from gpg itself.
+        key=$(grep -oP 'using \S+ key \K[0-9A-F]+' <<<"$out" | head -1)
+        warn "Mozilla signing key ${key:-(unknown)} is not in the keyring."
+        warn "Import it with: gpg --recv-keys ${key:-<key-id>}"
+        return 2
+    fi
+    return 1
+}
+
+# Fallback when the signature cannot be checked: compare the local size with
+# the Content-Length the archive reports.
+matches_remote_size() {
+    local remote local_size
+    remote=$(curl -sfIL "$SOURCE_URL/$NEW_TARBALL" \
+        | grep -i '^content-length:' | tail -1 | tr -dc '0-9')
+    [ -n "$remote" ] || return 2
+    local_size=$(stat -c%s "$NEW_TARBALL" 2>/dev/null)
+    [ "$remote" = "$local_size" ]
+}
+
+if ! skip_step 6; then
+    step 6 "Downloading $NEW_TARBALL"
+
+    # The detached signature is tiny - fetch it first so an already present
+    # tarball can be checked without downloading the ~600 MB file again.
+    rm -f "$NEW_TARBALL.asc"
+    wget -q -O "$NEW_TARBALL.asc" "$SOURCE_URL/$NEW_TARBALL.asc" \
+        || warn "No detached signature at $SOURCE_URL/$NEW_TARBALL.asc"
+
+    NEED_DOWNLOAD=1
+    if [ -f "$NEW_TARBALL" ]; then
+        info "$NEW_TARBALL is already here, checking it against $NEW_TARBALL.asc"
+        verify_tarball_signature
+        case $? in
+            0)  ok "Signature is good - reusing the local $NEW_TARBALL."
+                NEED_DOWNLOAD=0 ;;
+            1)  warn "Signature does NOT match - the local tarball is stale or corrupt."
+                rm -f "$NEW_TARBALL" ;;
+            2)  if matches_remote_size; then
+                    warn "Falling back to a size check: local size matches the archive."
+                    ok "Reusing the local $NEW_TARBALL."
+                    NEED_DOWNLOAD=0
+                else
+                    info "Size differs from the archive (or is unknown) - downloading again."
+                    rm -f "$NEW_TARBALL"
+                fi ;;
+        esac
+        if [ "$NEED_DOWNLOAD" -eq 1 ] && [ -f sources ] \
+           && grep -q "($NEW_TARBALL)" sources; then
+            info "Removing the stale $NEW_TARBALL entry from sources"
+            sed -i "\|($NEW_TARBALL)|d" sources
+        fi
+    fi
+
+    if [ "$NEED_DOWNLOAD" -eq 1 ]; then
+        run wget --progress=dot:giga -O "$NEW_TARBALL" "$SOURCE_URL/$NEW_TARBALL" \
+            || { rm -f "$NEW_TARBALL"; die "Download of $SOURCE_URL/$NEW_TARBALL failed"; }
+        ok "Downloaded $NEW_TARBALL ($(du -h "$NEW_TARBALL" | cut -f1))."
+        verify_tarball_signature
+        case $? in
+            0) ok "PGP signature verified." ;;
+            1) rm -f "$NEW_TARBALL" "$NEW_TARBALL.asc"
+               die "Downloaded $NEW_TARBALL does not match its PGP signature" ;;
+        esac
+    fi
+
+    rm -f "$NEW_TARBALL.asc"
+fi
+
+[ -f "$NEW_TARBALL" ] || die "$NEW_TARBALL is missing - re-run from step 6"
+
+#-----------------------------------------------------------------------------
+# Step 7: Download langpacks
+#-----------------------------------------------------------------------------
+
+if ! skip_step 7; then
+    step 7 "Downloading langpacks"
+
+    # The langpack tarball is named firefox-langpacks-<version>-<YYYYMMDD>.tar.xz.
+    # If one for this version is already here, reuse it instead of downloading
+    # every XPI again; the newest generation date wins.
+    LANGPACK_FILE=$(ls -1 firefox-langpacks-"$NEW_VERSION"-*.tar.xz 2>/dev/null \
+        | sort -V | tail -1)
+
+    if [ -n "$LANGPACK_FILE" ]; then
+        langpack_date="${LANGPACK_FILE##*-}"; langpack_date="${langpack_date%.tar.xz}"
+        info "Langpack tarball for $NEW_VERSION already present, generated $langpack_date"
+        info "Reusing $LANGPACK_FILE - delete it to force a fresh download."
+    else
+        [ -x ./moz-grab-langpacks ] || die "./moz-grab-langpacks not found or not executable"
+        run ./moz-grab-langpacks -a firefox "$NEW_VERSION" \
+            -u "$BUILD_URL/linux-x86_64/xpi/" \
+            || die "moz-grab-langpacks failed"
+
+        LANGPACK_FILE=$(ls -1 firefox-langpacks-"$NEW_VERSION"-*.tar.xz 2>/dev/null \
+            | sort -V | tail -1)
+        [ -n "$LANGPACK_FILE" ] || die "No firefox-langpacks-$NEW_VERSION-*.tar.xz was created"
+        info "Langpack tarball: $LANGPACK_FILE"
+    fi
+
+    # Source1 keeps the %{version}%{?pre_version} macros, only the date changes.
+    old_source1=$(spec_get '^Source1:\s*\K\S+')
+    langpack_date="${LANGPACK_FILE##*-}"; langpack_date="${langpack_date%.tar.xz}"
+    new_source1="firefox-langpacks-%{version}%{?pre_version}-$langpack_date.tar.xz"
+    if [ "$old_source1" != "$new_source1" ]; then
+        sed -i -E "s|^Source1:([[:space:]]*).*|Source1:\1$new_source1|" firefox.spec \
+            || die "Cannot update Source1 in firefox.spec"
+        info "Source1: $old_source1 -> $new_source1"
+    fi
+    ok "Using $LANGPACK_FILE; Source1 is up to date."
+fi
+
+if [ -z "$LANGPACK_FILE" ]; then
+    LANGPACK_FILE=$(ls -1 firefox-langpacks-"$NEW_VERSION"-*.tar.xz 2>/dev/null \
+        | sort -V | tail -1)
+fi
+[ -n "$LANGPACK_FILE" ] || die "No langpack tarball for $NEW_VERSION - re-run from step 7"
+
+#-----------------------------------------------------------------------------
+# Step 8: Upload new sources
+#-----------------------------------------------------------------------------
+
+if ! skip_step 8; then
+    step 8 "Uploading new sources to the lookaside cache"
+    check_kerberos
+    [ -f sources ] || die "No sources file in $PACKAGE_DIR"
+
+    # Everything except the Firefox source/langpack tarballs is kept as is.
+    mapfile -t KEPT_SOURCES < <(
+        sed -nE 's|^[A-Za-z0-9]+ \(([^)]+)\).*|\1|p' sources \
+            | grep -vE '^firefox-.*\.source\.tar\.xz$' \
+            | grep -vE '^firefox-langpacks-.*\.tar\.xz$'
+    )
+    info "Kept sources:    ${KEPT_SOURCES[*]:-(none)}"
+    info "Uploaded anew:   $NEW_TARBALL $LANGPACK_FILE"
+
+    # Trim the sources file first so that 'fedpkg sources' does not re-download
+    # the previous (huge) Firefox tarball, then fetch whatever is still missing.
+    cp sources sources.bak || die "Cannot back up the sources file"
+    trap 'if [ -f "$PACKAGE_DIR/sources.bak" ]; then mv -f "$PACKAGE_DIR/sources.bak" "$PACKAGE_DIR/sources"; fi' EXIT
+    grep -vE '\(firefox-.*\.source\.tar\.xz\)|\(firefox-langpacks-.*\.tar\.xz\)' \
+        sources.bak > sources
+    run fedpkg sources || die "fedpkg sources failed (Kerberos ticket expired?)"
+
+    for f in "${KEPT_SOURCES[@]}"; do
+        [ -f "$f" ] || die "Kept source $f is missing locally - cannot re-upload it"
+    done
+
+    run fedpkg new-sources "$NEW_TARBALL" "$LANGPACK_FILE" "${KEPT_SOURCES[@]}" \
+        || die "fedpkg new-sources failed"
+
+    trap - EXIT
+    rm -f sources.bak
+    ok "Uploaded $NEW_TARBALL and $LANGPACK_FILE; sources file refreshed."
+fi
+
+#-----------------------------------------------------------------------------
+# Step 9: Check and rebase patches
+#-----------------------------------------------------------------------------
+
+if [ "${#DROP_PATCHES[@]}" -gt 0 ] && skip_step 9; then
+    warn "--drop-patch ignored: resuming at step $RESUME_FROM, past the patch step."
+fi
+
+if ! skip_step 9; then
+    step 9 "Checking patches against the new sources"
+
+    for p in "${DROP_PATCHES[@]}"; do
+        drop_patch "$p"
+    done
+    [ "${#DROPPED_PATCHES[@]}" -gt 0 ] \
+        && ok "Dropped ${#DROPPED_PATCHES[@]} patch(es)."
+
+    mapfile -t SPEC_PATCHES < <(grep -oP '^Patch[0-9]*:\s*\K\S+' firefox.spec)
+    info "${#SPEC_PATCHES[@]} patches referenced by firefox.spec"
+    for p in "${SPEC_PATCHES[@]}"; do
+        case "$p" in
+            http*|%*) continue ;;
+        esac
+        [ -f "$p" ] || warn "Patch file referenced but missing: $p"
+    done
+    info "Patch application itself is verified by 'fedpkg prep' in the next step."
+    ok "Patch list checked."
+fi
+
+#-----------------------------------------------------------------------------
+# Step 10: Verify patches apply with fedpkg prep
+#-----------------------------------------------------------------------------
+
+if ! skip_step 10; then
+    step 10 "Verifying patches with fedpkg prep"
+    PREP_LOG=$(mktemp -t firefox-prep-XXXXXX.log)
+    if run fedpkg prep 2>&1 | tee "$PREP_LOG"; then
+        PREP_OK=1
+    else
+        PREP_OK=0
+    fi
+    if [ "$PREP_OK" -eq 0 ]; then
+        printf '\n%sfedpkg prep failed. Failing patch(es):%s\n' "$C_RED" "$C_OFF" >&2
+        grep -iE 'patch .*(FAILED|does not apply)|Hunk #.* FAILED|error:' "$PREP_LOG" \
+            | tail -20 >&2
+        printf '%sFull log: %s%s\n' "$C_YELLOW" "$PREP_LOG" "$C_OFF" >&2
+        die "Rebase or drop the failing patch, then re-run: $0 $NEW_VERSION --resume 10"
+    fi
+    rm -f "$PREP_LOG"
+    # The unpacked tree is kept for step 11 (NSS/NSPR version detection).
+    ok "All patches apply cleanly."
+    BUILD_STATUS="PASSED (fedpkg prep)"
+fi
+BUILD_STATUS="${BUILD_STATUS:-Not tested}"
+
+#-----------------------------------------------------------------------------
+# Step 11: Detect the NSS/NSPR versions shipped in the tarball
+#
+# Firefox bundles both sources; the versions are always taken from there and
+# written to the spec, never asked for:
+#   security/nss/lib/nss/nss.h    #define NSS_VERSION "3.127" _NSS_CUSTOMIZED
+#   nsprpub/pr/include/prinit.h   #define PR_VERSION  "4.40"
+#-----------------------------------------------------------------------------
+
+DETECTED_NSS_VERSION=""
+DETECTED_NSPR_VERSION=""
+
+# read_bundled_version <relative-header> <define-name>
+# Reads from the unpacked tree, falling back to the tarball when resuming.
+read_bundled_version() {
+    local header="$1" define="$2" path="firefox-$NEW_VERSION/$1"
+    if [ -f "$path" ]; then
+        grep -m1 -oP "^#define\s+$define\s+\"\K[^\"]+" "$path"
+    else
+        tar -xf "$NEW_TARBALL" --wildcards -O "*/$header" 2>/dev/null \
+            | grep -m1 -oP "^#define\s+$define\s+\"\K[^\"]+"
+    fi
+}
+
+# write_spec_version <macro> <old> <new> <label>
+write_spec_version() {
+    local macro="$1" old="$2" new="$3" label="$4"
+    if [ "$old" = "$new" ]; then
+        info "$macro: $new (unchanged)"
+        return 0
+    fi
+    sed -i -E "s|^%global([[:space:]]+)$macro[[:space:]]+.*|%global\1$macro $new|" \
+        firefox.spec || die "Cannot update $macro in firefox.spec"
+    grep -qE "^%global[[:space:]]+$macro[[:space:]]+$(sed 's/[.[\*^$]/\\&/g' <<<"$new")\$" \
+        firefox.spec || die "$macro was not updated in firefox.spec"
+    SPEC_NOTES+=("$label requirement $old -> $new (detected in the tarball)")
+    info "$macro: $old -> $new"
+}
+
+if ! skip_step 11; then
+    step 11 "Detecting the NSS/NSPR versions from the Firefox sources"
+
+    if [ ! -d "firefox-$NEW_VERSION" ]; then
+        info "No unpacked tree - reading the headers from $NEW_TARBALL (this takes a while)"
+    fi
+
+    DETECTED_NSS_VERSION=$(read_bundled_version \
+        "security/nss/lib/nss/nss.h" "NSS_VERSION")
+    [ -n "$DETECTED_NSS_VERSION" ] \
+        || die "Cannot read NSS_VERSION from security/nss/lib/nss/nss.h"
+
+    DETECTED_NSPR_VERSION=$(read_bundled_version \
+        "nsprpub/pr/include/prinit.h" "PR_VERSION")
+    [ -n "$DETECTED_NSPR_VERSION" ] \
+        || die "Cannot read PR_VERSION from nsprpub/pr/include/prinit.h"
+
+    # PR_VERSION may carry a suffix, e.g. "4.40 Beta" - keep the number only.
+    DETECTED_NSPR_VERSION="${DETECTED_NSPR_VERSION%% *}"
+
+    printf '\n%s   Firefox %s bundles NSS %s and NSPR %s%s\n\n' \
+        "$C_BOLD" "$NEW_VERSION" "$DETECTED_NSS_VERSION" "$DETECTED_NSPR_VERSION" "$C_OFF"
+
+    write_spec_version nss_version  "$OLD_NSS_VERSION"  "$DETECTED_NSS_VERSION"  NSS
+    write_spec_version nspr_version "$OLD_NSPR_VERSION" "$DETECTED_NSPR_VERSION" NSPR
+    NSS_VERSION="$DETECTED_NSS_VERSION"
+    NSPR_VERSION="$DETECTED_NSPR_VERSION"
+
+    info "Cleaning up the unpacked tree"
+    rm -rf "firefox-$NEW_VERSION/"
+    ok "NSS/NSPR versions written to firefox.spec."
+else
+    rm -rf "firefox-$NEW_VERSION/"
+fi
+
+#-----------------------------------------------------------------------------
+# Step 12: Local build (optional)
+#-----------------------------------------------------------------------------
+
+if ! skip_step 12; then
+    if [ "$DO_LOCAL_BUILD" -eq 0 ] && [ "$ASSUME_YES" -eq 0 ]; then
+        printf '\n'
+        confirm "Run a local build with 'fedpkg local'? It typically takes 1-2 hours." \
+            && DO_LOCAL_BUILD=1
+    fi
+    if [ "$DO_LOCAL_BUILD" -eq 1 ]; then
+        step 12 "Running a local build"
+        LOCAL_LOG=$(mktemp -t firefox-local-XXXXXX.log)
+        if run fedpkg local 2>&1 | tee "$LOCAL_LOG"; then
+            ok "Local build succeeded."
+            BUILD_STATUS="PASSED (fedpkg local)"
+            rm -f "$LOCAL_LOG"
+        else
+            printf '\n%sLocal build failed. Relevant output:%s\n' "$C_RED" "$C_OFF" >&2
+            grep -iE 'error:|No package .* found|not found|Installed \(but unpackaged\)' \
+                "$LOCAL_LOG" | tail -30 >&2
+            printf '%sFull log: %s%s\n' "$C_YELLOW" "$LOCAL_LOG" "$C_OFF" >&2
+            cat >&2 <<'EOF'
+
+Typical causes:
+  * Missing BuildRequires  - add "BuildRequires: <pkg>-devel" to firefox.spec
+  * Compile/linker error   - the source needs a patch for the new upstream API
+  * Unpackaged files       - adjust the %files section of firefox.spec
+
+EOF
+            die "Fix the build, then re-run: $0 $NEW_VERSION --resume 12"
+        fi
+    else
+        info "Skipping the local build."
+    fi
+fi
+
+#-----------------------------------------------------------------------------
+# Step 13: Commit the update
+#-----------------------------------------------------------------------------
+
+if ! skip_step 13; then
+    step 13 "Committing the update"
+    run git add firefox.spec sources || die "git add failed"
+
+    # Patch files touched by hand (rebased/dropped) are staged too, but never
+    # build artifacts.
+    mapfile -t CHANGED_PATCHES < <(git status --porcelain -- '*.patch' '*.diff' \
+        | awk '{print $NF}')
+    if [ "${#CHANGED_PATCHES[@]}" -gt 0 ]; then
+        info "Modified patch files: ${CHANGED_PATCHES[*]}"
+        if confirm "Stage these patch files as part of the update?" y; then
+            run git add -A -- "${CHANGED_PATCHES[@]}" || die "git add of patches failed"
+        fi
+    fi
+
+    printf '\n%sStaged changes:%s\n' "$C_BOLD" "$C_OFF"
+    git status --short --untracked-files=no
+
+    run fedpkg commit -c || die "fedpkg commit failed"
+    ok "Committed: $(git log -1 --pretty=%s)"
+fi
+
+#-----------------------------------------------------------------------------
+# Step 14: Present summary and push
+#-----------------------------------------------------------------------------
+
+step 14 "Update summary"
+
+cat <<EOF
+
+${C_BOLD}Firefox Update Summary: $OLD_VERSION -> $NEW_VERSION${C_OFF}
+
+  Version:       $OLD_VERSION -> $NEW_VERSION
+  Branch:        rawhide
+  Mozilla build: $BUILD_VERSION
+  Build status:  $BUILD_STATUS
+
+  Sources:
+    - $NEW_TARBALL
+    - $LANGPACK_FILE
+EOF
+
+if [ -n "$DETECTED_NSS_VERSION$DETECTED_NSPR_VERSION" ]; then
+    echo
+    echo "  NSS/NSPR (detected in the Firefox sources):"
+    echo "    - NSS:  $OLD_NSS_VERSION -> $DETECTED_NSS_VERSION"
+    echo "    - NSPR: $OLD_NSPR_VERSION -> $DETECTED_NSPR_VERSION"
+fi
+
+if [ "${#DROPPED_PATCHES[@]}" -gt 0 ]; then
+    echo
+    echo "  Dropped patches:"
+    printf '    - %s\n' "${DROPPED_PATCHES[@]}"
+fi
+
+if [ "${#SPEC_NOTES[@]}" -gt 0 ]; then
+    echo
+    echo "  SPEC changes:"
+    printf '    - %s\n' "${SPEC_NOTES[@]}"
+fi
+
+echo
+echo "  Commit:"
+git log -1 --pretty='    %h %s'
+echo
+
+if [ "$DO_PUSH" -eq 0 ] && [ "$ASSUME_YES" -eq 0 ]; then
+    confirm "Push the commit to rawhide on Fedora dist-git?" && DO_PUSH=1
+fi
+
+if [ "$DO_PUSH" -eq 1 ]; then
+    check_kerberos
+    run fedpkg push || die "fedpkg push failed"
+    ok "Pushed to Fedora dist-git (rawhide)."
+    info "Start a build with: fedpkg build"
+else
+    ok "Update prepared but not pushed. Push later with: fedpkg push"
+fi

diff --git a/firefox.spec b/firefox.spec
index 87b00a2..4af28c2 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -189,14 +189,14 @@ ExcludeArch: i686
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        156.0
-Release:        2%{?pre_tag}%{?dist}
+Version:        156.0.1
+Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 # Automatically converted from old format: MPLv1.1 or GPLv2+ or LGPLv2+ - review is highly recommended.
 License:        LicenseRef-Callaway-MPLv1.1 OR GPL-2.0-or-later OR LicenseRef-Callaway-LGPLv2+
 Source0:        https://archive.mozilla.org/pub/firefox/releases/%{version}%{?pre_version}/source/firefox-%{version}%{?pre_version}.source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20260910.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20260923.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        dump_syms-vendor.tar.xz
@@ -263,7 +263,6 @@ Patch402:        D324870.1789116963.diff
 Patch403:        D324871.1789116972.diff
 Patch404:        D324876.1789116899.diff
 Patch405:        D324877.1789117000.diff
-Patch406:        D326840.1789732703.diff
 
 # PGO/LTO patches
 Patch600:        pgo.patch
@@ -552,7 +551,6 @@ cat %{SOURCE49} | sed -e "s|LIBCLANG_RT_PLACEHOLDER|`pwd`/wasi-sdk-30/build/sysr
 %patch -P403 -p1 -b .D324871
 %patch -P404 -p1 -b .D324876
 %patch -P405 -p1 -b .D324877
-%patch -P406 -p1 -b .D326840
 
 # PGO patches
 %if %{build_with_pgo}
@@ -1208,6 +1206,9 @@ fi
 #---------------------------------------------------------------------
 
 %changelog
+* Wed Sep 23 2026 Martin Stransky <stransky@redhat.com> - 156.0.1-1
+- Update to latest upstream (156.0.1)
+
 * Thu Sep 17 2026 Martin Stransky <stransky@redhat.com> - 156.0-2
 - Disabled session restore on Gnome.
 

diff --git a/sources b/sources
index e453923..f16aedf 100644
--- a/sources
+++ b/sources
@@ -1,8 +1,8 @@
+SHA512 (firefox-156.0.1.source.tar.xz) = 80a32a79268b672206f5477ca6bfde620cb7419b27aac090e01f06df06990ee0bbd81bb5c4aa78ac1d0edb26b133b1c6fa11cb6522445eccd70c82e719a24d5b
+SHA512 (firefox-langpacks-156.0.1-20260923.tar.xz) = 21f49d42033554aee540f83661b8813f20b2863eee50cdb8a185a25c2156c8954df53fb4a68ae10b09067462ab323bdc0b6747a4b0ce4d6126aa0e792d666b38
 SHA512 (mochitest-python.tar.gz) = 089b1593068b76f4572af0086eaccf52a6a1299bfffb58593206d19bf021ae381f2380bbfeb4371586cd53706ff6dde3d240238b2caf19b96c57dfc2f4524e36
 SHA512 (dump_syms-vendor.tar.xz) = ee0ea52aac781b8dd48936a3d13b140bd725a48cc488d23693b68edbe3bcfba5723022dba3c3849d0da1bacf0e37ddd307cfc56304159f91b71495ce8a08b54a
 SHA512 (wasi-sdk-30.tar.gz) = c08b2ddb5d5cf5b48c5baba80c65c485a3049b473d2f2dd2babb402243a7709633c695dfee5f9cbba52fa25ad832f02f3b73d9ba1141c4d44dc30db70292a04d
 SHA512 (wasm-component-ld-vendor.tar.xz) = 356dc09502052198e99745199b8e10d803da9492ce34e41c6ae02cb8674fcc640cd5eafe68a03e4e61c984f7f6c7c8e5cdc3551251556fb3ae4631a340358fc0
 SHA512 (wasm-tools-vendor.tar.xz) = 502be0020d1828b75128e6127eb7bd77835ccebe4e5c179abc38d881bb1d1f8e15d2284796cd83574536c7c919a3e820e0952d323e8a3977e94bdef89cd8266a
 SHA512 (cbindgen-vendor.tar.xz) = dfefc3ec4c7b7d9fe1b024289866c5a919475b8b733e09ef1750d8d295ba78969ba187089dbc151d91779bf56a2d7898797c3d19db6e2d1cb84929750e86617d
-SHA512 (firefox-156.0.source.tar.xz) = 0463304a0898670d248114f66f7c235166ae2397c3989a7c878c96f0c589fbbba1f1c87432daa22633b9fadd94394adf1dc37f0e67d22b066c75efe5eead75ce
-SHA512 (firefox-langpacks-156.0-20260910.tar.xz) = 60123b95c0a90afd57249faedbfb58bc687d162b738970aa8db4d2985355ac9177de3f87e37c1f63528249bb149037060cf1313b3c5528ea0219199f8f8a2c62

diff --git a/wasi.patch b/wasi.patch
index 1586e3b..c2a955e 100644
--- a/wasi.patch
+++ b/wasi.patch
@@ -6,7 +6,7 @@ diff -up firefox-134.0.1/toolkit/moz.configure.wasi firefox-134.0.1/toolkit/moz.
          if wasi_sysroot:
              log.info("Using wasi sysroot in %s", wasi_sysroot)
 -            return ["--sysroot=%s" % wasi_sysroot]
-+            return ["--sysroot=%s" % wasi_sysroot, "-nodefaultlibs",  "-lc", "-lwasi-emulated-process-clocks", "-lc++", "-lc++abi", "/home/komat/CVS/firefox/firefox-156.0-build/firefox-156.0/wasi-sdk-30/build/sysroot/install/wasi-resource-dir/lib/wasm32-unknown-wasip1/libclang_rt.builtins.a"]
++            return ["--sysroot=%s" % wasi_sysroot, "-nodefaultlibs",  "-lc", "-lwasi-emulated-process-clocks", "-lc++", "-lc++abi", "/raid/CVS/firefox/firefox-156.0.1-build/firefox-156.0.1/wasi-sdk-30/build/sysroot/install/wasi-resource-dir/lib/wasm32-unknown-wasip1/libclang_rt.builtins.a"]
          return []
  
      set_config("WASI_SYSROOT", wasi_sysroot)