latest sync with brave branch chrome version 130

.eslintrc.js

@@ -21,14 +21,16 @@ module.exports = {
     'es6': true,
     'jest/globals': true
   },
-  'plugins': ['jest', 'licenses', 'react-hooks'],
+  'plugins': ['jest', 'licenses', 'no-unsanitized', 'react-hooks'],
   'globals': {
     'chrome': 'readonly'
   },
   'parserOptions': {
     'project': './tsconfig-lint.json'
   },
   'rules': {
+    'no-unsanitized/method': 'error',
+    'no-unsanitized/property': 'error',
     'licenses/header': [
       2,
       {
@@ -161,6 +163,19 @@ module.exports = {
         'react-hooks/rules-of-hooks': 'error', // Checks rules of Hooks
         'react-hooks/exhaustive-deps': 'warn' // Checks effect dependencies
       }
+    },
+    // opt-out stories for rules of hooks, or we can't use useState in the render functions
+    // https://github.com/storybookjs/eslint-plugin-storybook/pull/149
+    // Note: Just using that plugin doesn't help as we opt back in to the rules
+    // of hooks for wallet.
+    {
+      'files': [
+        'components/**/*.stories.tsx',
+        'components/**/stories/*.tsx',
+      ],
+      'rules': {
+        'react-hooks/rules-of-hooks': 'off', // Don't check hooks
+      }
     }
   ]
 }

.git-blame-ignore-revs

@@ -0,0 +1,19 @@
+# git hyper-blame master ignore list.
+#
+# This file contains a list of git hashes of revisions to be ignored by git
+# hyper-blame (in depot_tools). These revisions are considered "unimportant" in
+# that they are unlikely to be what you are interested in when blaming.
+#
+# Instructions:
+# - Only large (generally automated) reformatting or renaming PRs should be
+#   added to this list. Do not put things here just because you feel they are
+#   trivial or unimportant. If in doubt, do not put it on this list.
+# - Precede each revision with a comment containing the first line of its log.
+#   For bulk work over many commits, place all commits in a block with a single
+#   comment at the top describing the work done in those commits.
+# - Only put full 40-character hashes on this list (not short hashes or any
+#   other revision reference).
+# - Append to the bottom of the file (revisions should be in chronological order
+#   from oldest to newest).
+# - Because you must use a hash, you need to append to this list in a follow-up
+#   PR to the actual reformatting PR that you are trying to ignore.

.github/CODEOWNERS

@@ -10,6 +10,21 @@ DEPS @brave/deps-reviewers
 script/deps.py @brave/deps-reviewers
 package*.json @brave/js-deps-reviewers
 
+# BraveBrowserProcess public interface
+browser/brave_browser_process.h @bridiver
+
+# BraveComponent is deprecated
+components/brave_component_updater/browser/brave_component.h @bridiver @antonok-edm
+components/brave_component_updater/browser/local_data_files_observer.h @bridiver @antonok-edm
+
+# BravePrefServiceBridge is deprecated
+browser/android/preferences/brave_pref_service_bridge.cc @bridiver
+
+# sources.gni - see docs/gni_sources.md
+**/sources.gni @brave/sources-gni-reviewers
+**/*_sources.gni @brave/sources-gni-reviewers
+docs/gni_sources.md @brave/sources-gni-reviewers
+
 # Renderer code
 **/renderer/**/* @brave/renderer-reviewers
 
@@ -74,6 +89,7 @@ brave/components/brave_ads/core/internal/security/**/*.mm @brave/ads-client
 
 # Network
 browser/net/ @iefremov
+chromium_src/chrome/browser/net/profile_network_context_service.cc @brave/sec-team
 chromium_src/net/tools/transport_security_state_generator/input_file_parsers.cc @brave/sec-team
 
 # Tor

.github/PULL_REQUEST_TEMPLATE.md

@@ -5,9 +5,9 @@ Resolves
 * CI/run-audit-deps (1) - check for known npm/cargo vulnerabilities (audit_deps)
 * CI/run-network-audit (1) - run network-audit
 * CI/run-upstream-tests - run Chromium unit and browser tests on Linux and Windows (otherwise only on Linux)
-* CI/run-linux-arm64, CI/run-macos-arm64, CI/run-windows-arm64, CI/run-windows-x86 - run builds that would otherwise be skipped
+* CI/run-linux-arm64, CI/run-macos-x64, CI/run-windows-arm64, CI/run-windows-x86 - run builds that would otherwise be skipped
 * CI/skip - do not run CI builds (except noplatform)
-* CI/skip-linux-x64, CI/skip-android, CI/skip-macos-x64, CI/skip-ios, CI/skip-windows-x64 - skip CI builds for specific platforms
+* CI/skip-linux-x64, CI/skip-android, CI/skip-macos-arm64, CI/skip-ios, CI/skip-windows-x64 - skip CI builds for specific platforms
 * CI/skip-upstream-tests - do not run Chromium unit, or browser tests (otherwise only on Linux)
 * CI/skip-all-linters - do not run presubmit and lint checks
 * CI/storybook-url (1) - deploy storybook and provide a unique URL for each build

.github/workflows/compare-chromium-versions.yml

@@ -0,0 +1,48 @@
+name: Compare Chromium versions
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  compare-chromium-versions:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      PR_SHA: ${{ github.event.pull_request.head.sha }}
+    steps:
+      - name: Check if CI and merge are allowed based on the Chromium version in the target branch
+        run: |
+          shopt -s inherit_errexit
+          set -eEo pipefail
+
+          chromium_ver() { curl -fsS "https://raw.githubusercontent.com/${GITHUB_REPOSITORY:?}/${1:?}/package.json"|jq -r .config.projects.chrome.tag; }
+
+          pr_ver="$(chromium_ver "${PR_SHA:?}")"
+          target_ver="$(chromium_ver "${GITHUB_BASE_REF:?}")"
+
+          status() { echo "::${1:?}::${2:?}"; echo "$2" >>"${GITHUB_STEP_SUMMARY:?}"; }
+          label() { gh pr edit "${PR_NUMBER:?}" -R "${GITHUB_REPOSITORY:?}" "--${1:?}-label" chromium-version-mismatch >/dev/null; }
+          success() { status notice "${1:?}: CI ✅ | Merge ✅"; label remove; }
+          failure() {
+              case "${1:?}" in runci) ci=✅; label remove;; *) ci=🚫; label add;; esac
+              status error "${2:?}: CI $ci | Merge 🚫"
+              status error "Please rebase."
+              exit 2
+          }
+
+          echo "::notice::PR branch: ${pr_ver:?}, target branch: ${target_ver:?}"
+
+          if [[ "$pr_ver" == "$target_ver" ]]; then
+              success "Chromium version full match"
+          elif [[ "$(sort -V <<<"$target_ver"$'\n'"$pr_ver"|tail -n1)" == "$pr_ver" ]]; then
+              success "Chromium version is newer in the PR"
+          elif [[ "${pr_ver%%.*}" == "${target_ver%%.*}" ]]; then
+              success "Chromium major version match"
+          else
+              failure blockci "Chromium version mismatch"
+          fi

.github/workflows/rerun-compare-chromium-versions.yml

@@ -0,0 +1,47 @@
+name: Rerun Compare Chromium versions
+
+on:
+  pull_request:
+    branches:
+      - master
+      - '[0-9]+.[0-9]+.x'
+    paths:
+      - package.json
+    types:
+      - closed
+
+jobs:
+  rerun-compare-chromium-versions:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PR_SHA: ${{ github.event.pull_request.head.sha }}
+      TARGET_SHA: ${{ github.event.pull_request.base.sha }}
+    steps:
+      - run: |
+          shopt -s inherit_errexit
+          set -eEo pipefail
+
+          chromium_ver() { curl -fsS "https://raw.githubusercontent.com/${GITHUB_REPOSITORY:?}/${1:?}/package.json"|jq -r .config.projects.chrome.tag; }
+
+          pr_ver="$(chromium_ver "${PR_SHA:?}")"
+          target_ver="$(chromium_ver "${TARGET_SHA:?}")"
+
+          echo "::notice::PR branch: ${pr_ver:?}, target branch: ${target_ver:?}"
+
+          if [[ "${pr_ver%%.*}" != "${target_ver%%.*}" ]]; then
+              while read -r pr_number head_sha; do
+                  run_id="$(gh api "/repos/$GITHUB_REPOSITORY/actions/workflows/compare-chromium-versions.yml/runs?head_sha=${head_sha:?}" -q '.workflow_runs[0].id')"
+                  pr_url="https://github.com/brave/brave-core/pull/${pr_number:?}"
+                  if [[ "$run_id" ]]; then
+                      echo "Rerunning $run_id for $pr_url"
+                      gh -R "$GITHUB_REPOSITORY" run rerun "$run_id"
+                  else
+                      echo "No run found for $pr_url"
+                  fi
+                  sleep 1
+              done < <(gh -R "$GITHUB_REPOSITORY" pr list --limit 1000 --state open --base "$GITHUB_BASE_REF" --json number,headRefOid -q '.[]|"\(.number)\t\(.headRefOid)"')
+          else
+              echo "Chromium major versions match, nothing to do"
+          fi

.github/workflows/sync-and-rebase-pr-from-fork.yml

@@ -0,0 +1,70 @@
+name: Sync and rebase PR from fork
+
+on:
+  workflow_dispatch:
+    inputs:
+      PR_NUMBER:
+        required: true
+        description: "Number of the PR from the fork"
+
+jobs:
+  sync-and-rebase-pr-from-fork:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Git
+        run: |
+          git config user.name brave-builds
+          git config user.email [email protected]
+          git config push.default simple
+
+      - name: Sync and rebase PR from fork
+        env:
+          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          PR_NUMBER: ${{ inputs.PR_NUMBER }}
+        run: |
+          set -x
+          JQ="jq -e -r"
+
+          gh_pr_view=$(gh pr view "$PR_NUMBER" --json baseRefName,headRefName,headRepository,headRepositoryOwner,id,isCrossRepository,url)
+
+          baseRefName=$($JQ ".baseRefName" <<<"$gh_pr_view")
+          headRefName=$($JQ ".headRefName" <<<"$gh_pr_view")
+          headRepositoryName=$($JQ ".headRepository.name" <<<"$gh_pr_view")
+          headRepositoryOwnerLogin=$($JQ ".headRepositoryOwner.login" <<<"$gh_pr_view")
+          isCrossRepository=$($JQ ".isCrossRepository" <<<"$gh_pr_view")
+          url=$($JQ ".url" <<<"$gh_pr_view")
+
+          [[ "$isCrossRepository" = "true" ]] || { echo "PR is not cross repo. Exiting!"; exit 1; }
+
+          git remote add contributor "https://github.com/$headRepositoryOwnerLogin/$headRepositoryName.git" || :
+          contribHeadRefName="contributor-$headRepositoryOwnerLogin-$headRefName"
+          git fetch --no-tags contributor +"$headRefName":"$contribHeadRefName"
+
+          # Rebase the branch with the latest targeting branch HEAD
+          git checkout "$contribHeadRefName"
+          git fetch origin "$baseRefName"
+          if ! git rebase FETCH_HEAD; then
+            echo "Rebase conflict detected. Please resolve the conflicts and push the changes to your fork. Exiting!"
+            exit 1
+          fi
+          git push -f origin "$contribHeadRefName"
+
+          existing_prs=$(gh pr list -H "$contribHeadRefName" --json number)
+          if [[ "$existing_prs" = "[]" ]]; then
+            gh pr create \
+              --draft \
+              --base "$baseRefName" \
+              --head "$contribHeadRefName" \
+              --assignee "$headRepositoryOwnerLogin" \
+              --title "CI run for contributor PR #$PR_NUMBER" \
+              --body \
+          "## Description
+          This PR is created to run CI on the changes proposed in PR #$PR_NUMBER by @$headRepositoryOwnerLogin.
+
+          **This PR should not be merged.**"
+          fi