2025-10-13 15:16:42 +02:00
18 changed files with 400 additions and 361 deletions
--- a/chromium-121-rust-clang_lib.patch
+++ b/chromium-121-rust-clang_lib.patch
@@ -1,20 +1,17 @@
-diff -up chromium-121.0.6167.57/build/config/clang/BUILD.gn.rust-clang_lib chromium-121.0.6167.57/build/config/clang/BUILD.gn
--- chromium-121.0.6167.57/build/config/clang/BUILD.gn.rust-clang_lib	2024-01-10 16:43:01.000000000 +0100
-+++ chromium-121.0.6167.57/build/config/clang/BUILD.gn	2024-01-20 19:51:38.481992799 +0100
-@@ -166,8 +166,7 @@
-       _prefix = "lib"
+--- chromium-141.0.7390.37/build/config/clang/BUILD.gn	2025/10/01 10:09:34	1.1
+++ chromium-141.0.7390.37/build/config/clang/BUILD.gn	2025/10/01 11:38:41
+@@ -153,6 +153,7 @@
       _suffix = ""
       _ext = "a"
-
-      _clang_lib_dir = "$clang_base_path/lib/clang/$clang_version/lib"
+ 
 +      _libprefix = ""
       if (is_win) {
         _dir = "windows"
         _prefix = ""
-@@ -197,7 +196,19 @@
-         } else {
-           assert(false)  # Unhandled cpu type
+@@ -168,7 +169,19 @@
         }
+       } else if (is_apple) {
+         _dir = "darwin"
 -      } else if (is_linux || is_chromeos) {
 +      } else if (is_linux) {
 +        _libprefix = "64"
@@ -32,11 +29,12 @@ diff -up chromium-121.0.6167.57/build/config/clang/BUILD.gn.rust-clang_lib chrom
         if (current_cpu == "x64") {
           _dir = "x86_64-unknown-linux-gnu"
         } else if (current_cpu == "x86") {
-@@ -236,6 +247,7 @@
+@@ -215,7 +228,7 @@
         assert(false)  # Unhandled target platform
       }
 
+-      _clang_lib_dir = "$clang_base_path/lib/clang/$clang_version/lib"
 +      _clang_lib_dir = "$clang_base_path/lib${_libprefix}/clang/$clang_version/lib"
       _lib_file = "${_prefix}clang_rt.${_libname}${_suffix}.${_ext}"
       libs = [ "$_clang_lib_dir/$_dir/$_lib_file" ]
- 
+     }
--- a/chromium-125-compiler.patch
+++ b/chromium-125-compiler.patch
@@ -1,6 +1,8 @@
--- chromium-140.0.7259.2/build/config/compiler/BUILD.gn	2025/06/27 14:34:16	1.1
-+++ chromium-140.0.7259.2/build/config/compiler/BUILD.gn	2025/06/27 14:36:19
-@@ -312,9 +312,7 @@
+Index: chromium-141.0.7378.3/build/config/compiler/BUILD.gn
+===================================================================
+--- chromium-141.0.7378.3.orig/build/config/compiler/BUILD.gn
+++ chromium-141.0.7378.3/build/config/compiler/BUILD.gn
+@@ -337,9 +337,7 @@ config("compiler") {
 
   configs += [
     # See the definitions below.
@@ -10,7 +12,7 @@
     ":compiler_codegen",
     ":compiler_deterministic",
     ":clang_warning_suppression",
-@@ -603,66 +603,6 @@
+@@ -634,64 +632,6 @@ config("compiler") {
     ldflags += [ "-Wl,-z,keep-text-section-prefix" ]
   }
 
@@ -62,14 +64,12 @@
 -      cflags += [ "-ffp-contract=off" ]
 -    }
 -
-    # Enable ELF CREL (see crbug.com/357878242) for all platforms that use ELF
-    # (excluding toolchains that use an older version of LLVM).
+-    # Enable ELF CREL (see crbug.com/357878242) for all platforms that use ELF.
 -    # TODO(crbug.com/376278218): This causes segfault on Linux ARM builds.
 -    # It also causes segfault on Linux s390x:
 -    # https://github.com/llvm/llvm-project/issues/149511
 -    if (is_linux && use_lld && !llvm_android_mainline && current_cpu != "arm" &&
-        current_cpu != "s390x" &&
-        default_toolchain != "//build/toolchain/cros:target") {
+-        current_cpu != "s390x") {
 -      cflags += [ "-Wa,--crel,--allow-experimental-crel" ]
 -    }
 -  }
@@ -77,7 +77,7 @@
   # C11/C++11 compiler flags setup.
   # ---------------------------
   if (is_linux || is_chromeos || is_android || current_os == "aix") {
-@@ -1598,43 +1539,6 @@
+@@ -1642,43 +1582,6 @@ config("compiler_deterministic") {
     }
   }
 
@@ -121,7 +121,7 @@
   # Tells the compiler not to use absolute paths when passing the default
   # paths to the tools it invokes. We don't want this because we don't
   # really need it and it can mess up the RBE cache entries.
-@@ -1661,87 +1565,6 @@
+@@ -1705,87 +1608,6 @@ config("compiler_deterministic") {
   }
 }
 
@@ -209,7 +209,7 @@
 # Controls the usage of a warning suppression mapping (WSM) file to suppress
 # warnings based on the path of the file they come from. It's controlled by the
 # `clang_warning_suppression_file` gn argument , which points to a text file
-@@ -2229,10 +2052,6 @@
+@@ -2286,10 +2108,6 @@ config("chromium_code") {
     }
   } else {
     cflags = [ "-Wall" ]
@@ -220,7 +220,7 @@
 
     # In Chromium code, we define __STDC_foo_MACROS in order to get the
     # C99 macros on Mac and Linux.
-@@ -2241,24 +2060,6 @@
+@@ -2298,24 +2116,6 @@ config("chromium_code") {
       "__STDC_FORMAT_MACROS",
     ]
 
@@ -236,7 +236,7 @@
 -      # ChromeOS's toolchain supports a high-quality _FORTIFY_SOURCE=3
 -      # implementation with a few custom glibc patches. Use that if it's
 -      # available.
-      if (is_chromeos_device && !lacros_use_chromium_toolchain) {
+-      if (is_chromeos_device) {
 -        fortify_level = "3"
 -      }
 -      defines += [ "_FORTIFY_SOURCE=" + fortify_level ]
@@ -245,7 +245,7 @@
     if (is_apple) {
       cflags_objc = [ "-Wimplicit-retain-self" ]
       cflags_objcc = [ "-Wimplicit-retain-self" ]
-@@ -2673,7 +2474,8 @@
+@@ -2735,7 +2535,8 @@ config("default_stack_frames") {
 # [0]: https://pinpoint-dot-chromeperf.appspot.com/job/147634a8be0000
 # [1]: https://pinpoint-dot-chromeperf.appspot.com/job/132bc772be0000
 # [2]: https://crrev.com/c/5447532
@@ -255,7 +255,7 @@
   if (is_win) {
     # clang-cl's /O2 corresponds to clang's -O3, and really want -O2 for
     # consistency with the other platforms.
-@@ -2722,7 +2524,8 @@
+@@ -2784,7 +2585,8 @@ config("optimize") {
 }
 
 # Turn off optimizations.
@@ -265,7 +265,7 @@
   if (is_win) {
     cflags = [
       "/Od",  # Disable optimization.
-@@ -2757,7 +2560,8 @@
+@@ -2819,7 +2621,8 @@ config("no_optimize") {
 # Turns up the optimization level. Used to explicitly enable -O2 instead of
 # -Os for select targets on platforms that use optimize_for_size. No-op
 # elsewhere.
@@ -275,7 +275,7 @@
   ldflags = common_optimize_on_ldflags
   if (is_win) {
     # Favor speed over size, /O2 must be before the common flags.
-@@ -2778,7 +2582,8 @@
+@@ -2840,7 +2643,8 @@ config("optimize_max") {
 #
 # TODO(crbug.com/41259697) - rework how all of these configs are related
 # so that we don't need this disclaimer.
@@ -285,7 +285,7 @@
   ldflags = common_optimize_on_ldflags
   if (is_win) {
     # Favor speed over size, /O2 must be before the common flags.
-@@ -2795,7 +2600,8 @@
+@@ -2857,7 +2661,8 @@ config("optimize_speed") {
   rustflags = [ "-Copt-level=3" ]
 }
 
@@ -295,7 +295,7 @@
   cflags = [ "-O1" ] + common_optimize_on_cflags
   rustflags = [ "-Copt-level=1" ]
   ldflags = common_optimize_on_ldflags
-@@ -2922,7 +2728,8 @@
+@@ -2984,7 +2789,8 @@ config("win_pdbaltpath") {
 }
 
 # Full symbols.
@@ -305,7 +305,7 @@
   rustflags = []
   configs = []
   if (is_win) {
-@@ -3089,7 +2896,8 @@
+@@ -3140,7 +2946,8 @@ config("symbols") {
 # Minimal symbols.
 # This config guarantees to hold symbol for stack trace which are shown to user
 # when crash happens in unittests running on buildbot.
@@ -315,7 +315,7 @@
   rustflags = []
   if (is_win) {
     # Functions, files, and line tables only.
-@@ -3165,7 +2973,8 @@
+@@ -3216,7 +3023,8 @@ config("minimal_symbols") {
 # This configuration contains function names only. That is, the compiler is
 # told to not generate debug information and the linker then just puts function
 # names in the final debug information.
--- a/chromium-133-bring_back_and_disable_allowlist.patch
+++ b/chromium-133-bring_back_and_disable_allowlist.patch
@@ -1,6 +1,8 @@
--- chromium-133.0.6943.98/media/base/media_switches.h	2025/02/18 15:56:48	1.1
-+++ chromium-133.0.6943.98/media/base/media_switches.h	2025/02/18 15:57:20
-@@ -516,6 +516,8 @@
+Index: chromium-141.0.7378.3/media/base/media_switches.h
+===================================================================
+--- chromium-141.0.7378.3.orig/media/base/media_switches.h
+++ chromium-141.0.7378.3/media/base/media_switches.h
+@@ -519,6 +519,8 @@ MEDIA_EXPORT BASE_DECLARE_FEATURE(
 
 MEDIA_EXPORT BASE_DECLARE_FEATURE(kUseWindowBoundsForPip);
 
@@ -9,11 +11,13 @@
 MEDIA_EXPORT BASE_DECLARE_FEATURE(kMediaLogToConsole);
 
 MEDIA_EXPORT BASE_DECLARE_FEATURE(kLibvpxUseChromeThreads);
--- chromium-133.0.6943.98/media/base/media_switches.cc	2025/02/18 15:56:07	1.1
-+++ chromium-133.0.6943.98/media/base/media_switches.cc	2025/02/18 15:56:48
-@@ -1657,6 +1657,11 @@
-              "UseWindowBoundsForPip",
-              base::FEATURE_ENABLED_BY_DEFAULT);
+Index: chromium-141.0.7378.3/media/base/media_switches.cc
+===================================================================
+--- chromium-141.0.7378.3.orig/media/base/media_switches.cc
+++ chromium-141.0.7378.3/media/base/media_switches.cc
+@@ -1687,6 +1687,11 @@ bool IsRestrictOwnAudioSupported() {
+ #endif
+ }
 
 +// Enables FFmpeg allow lists for supported codecs / containers.
 +BASE_FEATURE(kFFmpegAllowLists,
@@ -21,11 +25,13 @@
 +             base::FEATURE_DISABLED_BY_DEFAULT);
 +
 #if BUILDFLAG(IS_WIN)
- // Enables audio offload when supported by endpoints.
- BASE_FEATURE(kAudioOffload, "AudioOffload", base::FEATURE_DISABLED_BY_DEFAULT);
--- chromium-133.0.6943.98/media/ffmpeg/ffmpeg_common.cc	2025/02/18 16:03:18	1.1
-+++ chromium-133.0.6943.98/media/ffmpeg/ffmpeg_common.cc	2025/02/18 16:04:02
-@@ -19,6 +19,7 @@
+ bool IsMediaFoundationD3D11VideoCaptureEnabled() {
+   return base::FeatureList::IsEnabled(kMediaFoundationD3D11VideoCapture);
+Index: chromium-141.0.7378.3/media/ffmpeg/ffmpeg_common.cc
+===================================================================
+--- chromium-141.0.7378.3.orig/media/ffmpeg/ffmpeg_common.cc
+++ chromium-141.0.7378.3/media/ffmpeg/ffmpeg_common.cc
+@@ -16,6 +16,7 @@
 #include "media/base/audio_decoder_config.h"
 #include "media/base/decoder_buffer.h"
 #include "media/base/encryption_scheme.h"
@@ -33,7 +39,7 @@
 #include "media/base/media_util.h"
 #include "media/base/supported_types.h"
 #include "media/base/video_aspect_ratio.h"
-@@ -76,7 +76,8 @@
+@@ -72,7 +73,8 @@ const char* GetAllowedVideoDecoders() {
 void ApplyCodecContextSecuritySettings(AVCodecContext* codec_context) {
   // Future versions of ffmpeg may copy the allow list from the format
   // context.
@@ -43,9 +49,11 @@
     // Note: FFmpeg will try to free this string, so we must duplicate it.
     codec_context->codec_whitelist =
         av_strdup(codec_context->codec_type == AVMEDIA_TYPE_AUDIO
--- chromium-133.0.6943.98/media/filters/ffmpeg_glue.cc	2025/02/18 16:06:06	1.1
-+++ chromium-133.0.6943.98/media/filters/ffmpeg_glue.cc	2025/02/18 16:07:06
-@@ -131,8 +131,10 @@
+Index: chromium-141.0.7378.3/media/filters/ffmpeg_glue.cc
+===================================================================
+--- chromium-141.0.7378.3.orig/media/filters/ffmpeg_glue.cc
+++ chromium-141.0.7378.3/media/filters/ffmpeg_glue.cc
+@@ -137,8 +137,10 @@ FFmpegGlue::FFmpegGlue(FFmpegURLProtocol
   // memory usage.
   //
   // Note: FFmpeg will try to free these strings, so we must duplicate them.
--- a/chromium-135-add_map_droppable.patch
+++ b/chromium-135-add_map_droppable.patch
@@ -1,22 +0,0 @@
--- chromium-135.0.7023.0/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc	2025/04/04 08:28:56	1.1
-+++ chromium-135.0.7023.0/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc	2025/04/04 08:29:47
-@@ -34,6 +34,10 @@
- #include "sandbox/linux/system_headers/linux_syscalls.h"
- #include "sandbox/linux/system_headers/linux_time.h"
- 
-+#if !defined(MAP_DROPPABLE)
-+#define MAP_DROPPABLE	0x08    // Zero memory under memory pressure.
-+#endif
-+
- #if BUILDFLAG(IS_LINUX) && !defined(__arm__) && !defined(__aarch64__) && \
-     !defined(PTRACE_GET_THREAD_AREA)
- // Also include asm/ptrace-abi.h since ptrace.h in older libc (for instance
-@@ -236,7 +240,7 @@
-   // TODO(davidung), remove MAP_DENYWRITE with updated Tegra libraries.
-   const uint64_t kAllowedMask = MAP_SHARED | MAP_PRIVATE | MAP_ANONYMOUS |
-                                 MAP_STACK | MAP_NORESERVE | MAP_FIXED |
-                                MAP_DENYWRITE | MAP_LOCKED |
-+                                MAP_DENYWRITE | MAP_LOCKED | MAP_DROPPABLE |
-                                 kArchSpecificAllowedMask;
-   const Arg<int> flags(3);
-   return If((flags & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS());
--- a/chromium-140-keep-__rust_no_alloc_shim_is_unstable.patch
+++ b/chromium-140-keep-__rust_no_alloc_shim_is_unstable.patch
@@ -1,8 +1,10 @@
--- chromium-140.0.7339.5/build/rust/allocator/lib.rs	2025/08/12 12:48:58	1.1
-+++ chromium-140.0.7339.5/build/rust/allocator/lib.rs	2025/08/12 12:49:30
-@@ -90,6 +90,12 @@
-     #[linkage = "weak"]
-     fn __rust_no_alloc_shim_is_unstable_v2() {}
+Index: chromium-141.0.7378.3/build/rust/allocator/lib.rs
+===================================================================
+--- chromium-141.0.7378.3.orig/build/rust/allocator/lib.rs
+++ chromium-141.0.7378.3/build/rust/allocator/lib.rs
+@@ -96,6 +96,12 @@ mod both_allocators {
+         0
+     }
 
 +    // TODO(crbug.com/422538133) Remove after rolling past
 +    // https://github.com/rust-lang/rust/pull/141061
@@ -11,5 +13,5 @@
 +    static __rust_no_alloc_shim_is_unstable: u8 = 0;
 +
     // Mangle the symbol name as rustc expects.
+     // TODO(crbug.com/440481922): Remove this after rolling past https://github.com/rust-lang/rust/pull/143387
     #[rustc_std_internal_symbol]
-     #[allow(non_upper_case_globals)]
--- a/chromium-140.0.7339.185-linux.tar.xz
+++ b/chromium-140.0.7339.185-linux.tar.xz
--- a/chromium-141-csss_style_sheet.patch
+++ b/chromium-141-csss_style_sheet.patch
@@ -0,0 +1,16 @@
+Fix ftbfs
+
+v8/include/cppgc/visitor.h:440:19: error: invalid application of 'sizeof' to an incomplete type 'blink::CSSStyleSheet'
+  440 |     static_assert(sizeof(T), "Pointee type must be fully defined.");
+
+diff -up chromium-141.0.7390.37/third_party/blink/renderer/bindings/scripts/bind_gen/observable_array.py.ftbfs-csss_style_sheet chromium-141.0.7390.37/third_party/blink/renderer/bindings/scripts/bind_gen/observable_array.py
+--- chromium-141.0.7390.37/third_party/blink/renderer/bindings/scripts/bind_gen/observable_array.py.ftbfs-csss_style_sheet	2025-09-23 22:21:14.000000000 +0200
+++ chromium-141.0.7390.37/third_party/blink/renderer/bindings/scripts/bind_gen/observable_array.py	2025-10-01 17:55:51.303926035 +0200
+@@ -433,6 +433,7 @@ def generate_observable_array(observable
+     header_node.accumulator.add_include_headers([
+         component_export_header(api_component, for_testing),
+         "third_party/blink/renderer/bindings/core/v8/idl_types.h",
+        "third_party/blink/renderer/core/css/css_style_sheet.h",
+         "third_party/blink/renderer/platform/bindings/observable_array.h",
+     ])
+     source_node.accumulator.add_include_headers([
--- a/chromium-141-no_cxx_modules.patch
+++ b/chromium-141-no_cxx_modules.patch
@@ -0,0 +1,14 @@
+--- chromium-141.0.7390.37/third_party/pthreadpool/chromium/jobs.cc	2025/10/02 13:48:22	1.1
+++ chromium-141.0.7390.37/third_party/pthreadpool/chromium/jobs.cc	2025/10/02 13:50:01
+@@ -22,9 +22,10 @@
+ // Note that we can't use #if !defined(__cpp_module) due to it not actually
+ // being defined - see https://github.com/llvm/llvm-project/issues/71364 and
+ // https://github.com/llvm/llvm-project/blob/b251c29af45d3440374f53bb4c1645e5968593f7/clang/lib/Frontend/InitPreprocessor.cpp#L747
+-#ifndef USE_LIBCXX_MODULES
+#if 1
+ #include <atomic>
+ #define _LIBCPP_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+ using namespace std;
+ #endif
+ 
--- a/chromium-141-use_libcxx_modules.patch
+++ b/chromium-141-use_libcxx_modules.patch
@@ -0,0 +1,28 @@
+Fix FTBFS
+
+../../build/modules/linux-x64/module.modulemap:11:12: error: header '../../linux/debian_bullseye_amd64-sysroot/usr/include/alloca.h' not found
+   11 |     header "../../linux/debian_bullseye_amd64-sysroot/usr/include/alloca.h"
+      |            ^
+1 error generated
+
+diff -up chromium-141.0.7390.37/build/config/BUILDCONFIG.gn.me chromium-141.0.7390.37/build/config/BUILDCONFIG.gn
+--- chromium-141.0.7390.37/build/config/BUILDCONFIG.gn.me	2025-10-01 17:39:47.242174153 +0200
+++ chromium-141.0.7390.37/build/config/BUILDCONFIG.gn	2025-10-01 17:49:54.736578295 +0200
+@@ -557,6 +557,8 @@ foreach(_target_type,
+         ]) {
+   template(_target_type) {
+     target(_target_type, target_name) {
+      use_libcxx_modules = false
+
+       forward_variables_from(invoker, "*", TESTONLY_AND_VISIBILITY)
+       forward_variables_from(invoker, TESTONLY_AND_VISIBILITY)
+       if (!defined(inputs)) {
+@@ -660,6 +662,8 @@ foreach(_target_type,
+       # TODO(crbug.com/326584510): Reclient doesn't respect this variable, see
+       # rbe_bug_326584510_missing_inputs in //build/config/clang/clang.gni
+       _uses_cflags = false
+      use_libcxx_modules = false
+ 
+       if (defined(sources)) {
+         foreach(f, sources) {
+           if (string_replace(f + ".END", ".cc.END", "") != f + ".END" ||
--- a/chromium-141.0.7390.76-linux.tar.xz
+++ b/chromium-141.0.7390.76-linux.tar.xz
--- a/chromium.changes
+++ b/chromium.changes
@@ -1,3 +1,87 @@
+-------------------------------------------------------------------
+Thu Oct  9 21:12:28 UTC 2025 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Chromium 141.0.7390.76:
+  * Do not send URLs as AIM input. This is to resolve a privacy
+    concern, around passing urls to AI Mode.
+
+-------------------------------------------------------------------
+Thu Oct  9 08:53:01 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- exclude the main tarball from the src.rpm to reduce size
+  (it is anyway fully referenced, so no supply chain concern)
+
+-------------------------------------------------------------------
+Wed Oct  8 12:04:56 UTC 2025 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Chromium 141.0.7390.65 (boo#1251334):
+  * CVE-2025-11458: Heap buffer overflow in Sync
+  * CVE-2025-11460: Use after free in Storage
+  * CVE-2025-11211: Out of bounds read in WebCodecs
+
+-------------------------------------------------------------------
+Wed Oct  1 18:16:47 CEST 2025 - ro@suse.de
+
+- Chromium 141.0.7390.54
+  (stable released 2025-09-30) (boo#1250780)
+  * CVE-2025-11205: Heap buffer overflow in WebGPU
+  * CVE-2025-11206: Heap buffer overflow in Video
+  * CVE-2025-11207: Side-channel information leakage in Storage
+  * CVE-2025-11208: Inappropriate implementation in Media
+  * CVE-2025-11209: Inappropriate implementation in Omnibox
+  * CVE-2025-11210: Side-channel information leakage in Tab
+  * CVE-2025-11211: Out of bounds read in Media
+  * CVE-2025-11212: Inappropriate implementation in Media
+  * CVE-2025-11213: Inappropriate implementation in Omnibox
+  * CVE-2025-11215: Off by one error in V8
+  * CVE-2025-11216: Inappropriate implementation in Storage
+  * CVE-2025-11219: Use after free in V8
+  * Various fixes from internal audits, fuzzing and other initiatives
+
+- added patches:
+  chromium-141-csss_style_sheet.patch (from fedora)
+  chromium-141-use_libcxx_modules.patch (from fedora)
+  chromium-141-no_cxx_modules.patch
+  (one more fallout from clang modules)
+- modified patches: (context)
+  ppc-fedora-0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch
+  ppc-fedora-Sandbox-linux-services-credentials.cc-PPC.patch
+  ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch
+  ppc-fedora-add-ppc64-architecture-to-extensions.diff
+  ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
+  (updated from debian)
+  chromium-121-rust-clang_lib.patch (redone)
+- keeplibs:
+  added third_party/federated_compute (pulled in)
+  added third_party/oak (needed by federated_compute)
+
+-------------------------------------------------------------------
+Wed Sep 24 17:21:18 UTC 2025 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Chromium 141.0.7390.37
+  (beta released 2025-09-24)
+- modified patches:
+  chromium-125-compiler.patch
+  chromium-133-bring_back_and_disable_allowlist.patch
+  chromium-140-keep-__rust_no_alloc_shim_is_unstable.patch
+- dropped patches:
+  ppc-fedora-fix-rustc.patch (obsolete)
+  chromium-135-add_map_droppable.patch
+
+-------------------------------------------------------------------
+Wed Sep 24 06:48:00 UTC 2025 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Chromium 140.0.7339.207 (boo#1250472)
+  * CVE-2025-10890: Side-channel information leakage in V8
+  * CVE-2025-10891: Integer overflow in V8
+  * CVE-2025-10892: Integer overflow in V8
+
+-------------------------------------------------------------------
+Mon Sep 22 10:34:45 CEST 2025 - ro@suse.de
+
+- use the same llvm version on recent distros,
+  build currently fails with lvm21 
+
 -------------------------------------------------------------------
 Thu Sep 18 00:54:55 CEST 2025 - ro@suse.de

--- a/chromium.spec
+++ b/chromium.spec
@@ -66,6 +66,7 @@
 %define node_version %(rpm -q --qf "%%{version}" nodejs%{node_ver})
 # LLVM version
 %define llvm_version 19
+%define llvm_version_long 19.1.7
 # RUST version
 %define rust_version 1.86
 # GCC version
@@ -117,12 +118,13 @@
 %global official_build 1

 Name:           chromium%{n_suffix}
-Version:        140.0.7339.185
+Version:        141.0.7390.76
 Release:        0
 Summary:        Google's open source browser project
 License:        BSD-3-Clause AND LGPL-2.1-or-later
 URL:            https://www.chromium.org/
 Source0:        https://github.com/chromium-linux-tarballs/chromium-tarballs/releases/download/%{version}/chromium-%{version}-linux.tar.xz
+NoSource:       0
 # https://github.com/evanw/esbuild/archive/refs/tags/v%%{esbuild_version}.tar.gz
 Source1:        esbuild-%{esbuild_version}.tar.gz
 Source2:        esbuild-%{esbuild_version}-vendor.tar.gz
@@ -164,10 +166,12 @@ Patch369:       chromium-132-pdfium-explicit-template.patch
 Patch371:       chromium-133-bring_back_and_disable_allowlist.patch
 Patch373:       chromium-134-type-mismatch-error.patch
 Patch375:       chromium-131-fix-qt-ui.pach
-Patch376:       chromium-135-add_map_droppable.patch
 Patch377:       chromium-139-deterministic.patch
 Patch378:       chromium-139-pdfium-openjpeg-CVE-2025-54874.patch
 Patch379:       chromium-140-keep-__rust_no_alloc_shim_is_unstable.patch
+Patch380:       chromium-141-use_libcxx_modules.patch
+Patch381:       chromium-141-csss_style_sheet.patch
+Patch382:       chromium-141-no_cxx_modules.patch
 # conditionally applied patches ppc64le only
 Patch401:       ppc-fedora-add-ppc64-architecture-string.patch
 Patch402:       ppc-fedora-0001-linux-seccomp-bpf-ppc64-glibc-workaround-in-SIGSYS-h.patch
@@ -209,7 +213,6 @@ Patch437:       ppc-fedora-0001-Implement-support-for-ppc64-on-Linux.patch
 Patch438:       ppc-fedora-0001-Implement-support-for-PPC64-on-Linux.patch
 Patch439:       ppc-fedora-0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.patch
 Patch440:       ppc-fedora-fix-clang-selection.patch
-Patch441:       ppc-fedora-fix-rustc.patch
 Patch442:       ppc-fedora-fix-rust-linking.patch
 Patch443:       ppc-fedora-fix-breakpad-compile.patch
 Patch444:       ppc-fedora-fix-partition-alloc-compile.patch
@@ -439,39 +442,27 @@ BuildRequires:  pkgconfig(libwebp) >= 0.4.0
 %if %{with system_zstd}
 BuildRequires:  pkgconfig(libzstd) >= 1.5.5
 %endif
+# compiler selection
 %if %{with clang}
-%if 0%{?suse_version} <= 1500
+# clang/llvm case
 BuildRequires:  clang%{llvm_version}
 %if %{with libstdcpp}
 BuildRequires:  libstdc++6-devel-gcc%{gcc_version}
 %else
 BuildRequires:  clang%{llvm_version}-devel
-#BuildRequires:  libc++-devel
-BuildRequires:  libc++.so >= %{llvm_version}
+BuildRequires:  libc++.so = %{llvm_version_long}
+BuildRequires:  libc++1 = %{llvm_version_long}
+BuildRequires:  libc++abi.so = %{llvm_version_long}
+BuildRequires:  libc++abi1 = %{llvm_version_long}
 %endif
 BuildRequires:  lld%{llvm_version}
 BuildRequires:  llvm%{llvm_version}
 #!BuildIgnore:  gcc
 %else
-BuildRequires:  clang
-%if %{with libstdcpp}
-BuildRequires:  libstdc++-devel
-%else
-BuildRequires:  libc++-devel
-%endif
-BuildRequires:  lld
-BuildRequires:  llvm
-%endif
-%endif
-%if %{without clang}
+# gcc case
 BuildRequires:  binutils-gold
-%if 0%{?suse_version} <= 1500
 BuildRequires:  gcc%{gcc_version}
 BuildRequires:  gcc%{gcc_version}-c++
-%else
-BuildRequires:  gcc
-BuildRequires:  gcc-c++
-%endif
 %endif
 %if 0%{?suse_version} >= 1699
 #!BuildIgnore:  rpmlint rpmlint-Factory rpmlint-mini
@@ -658,6 +649,7 @@ keeplibs=(
    third_party/farmhash
    third_party/fast_float
    third_party/fdlibm
+    third_party/federated_compute
    third_party/fft2d
    third_party/flatbuffers
    third_party/fp16
@@ -684,6 +676,7 @@ keeplibs=(
    third_party/libaom/source/libaom/third_party/SVT-AV1
    third_party/libaom/source/libaom/third_party/vector
    third_party/libaom/source/libaom/third_party/x86inc
+    third_party/libc++
    third_party/libgav1
    third_party/libjingle
    third_party/libphonenumber
@@ -712,6 +705,7 @@ keeplibs=(
    third_party/nasm
    third_party/nearby
    third_party/node
+    third_party/oak
    third_party/omnibox_proto
    third_party/one_euro_filter
    third_party/openscreen
@@ -1025,7 +1019,6 @@ sed -i 's|OFFICIAL_BUILD|GOOGLE_CHROME_BUILD|g' tools/generate_shim_headers/gene
 %endif
 myconf_gn+=" is_debug=false"
 myconf_gn+=" dcheck_always_on=false"
-myconf_gn+=" enable_nacl=false"
 %if %{with swiftshader}
 myconf_gn+=" use_swiftshader_with_subzero=true"
 %endif
--- a/ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
+++ b/ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
--- a/ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch
+++ b/ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch
@@ -4979,7 +4979,8 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/rand/r
 ===================================================================
 --- chromium-138.0.7204.35.orig/third_party/boringssl/src/crypto/fipsmodule/rand/rand.cc.inc
 +++ chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/rand/rand.cc.inc
-@@ -431,6 +431,11 @@ bcm_infallible BCM_rand_bytes_with_addit
+Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/sha/internal.h
+@@ -430,6 +430,11 @@
     // Take a read lock around accesses to |state->drbg|. This is needed to
     // avoid returning bad entropy if we race with
     // |rand_thread_state_clear_all|.
@@ -4990,8 +4991,7 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/rand/r
 +    // kernel, syscalls made with |syscall| did not abort the transaction.
     CRYPTO_MUTEX_lock_read(&state->clear_drbg_lock);
 #endif
-     if (!CTR_DRBG_reseed(&state->drbg, seed, reseed_additional_data,
-Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/sha/internal.h
+     if (!CTR_DRBG_reseed_ex(&state->drbg, seed, sizeof(seed),
 ===================================================================
 --- chromium-138.0.7204.35.orig/third_party/boringssl/src/crypto/fipsmodule/sha/internal.h
 +++ chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/sha/internal.h
--- a/ppc-fedora-0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch
+++ b/ppc-fedora-0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch
@@ -49,8 +49,8 @@ Index: chromium-136.0.7103.48/sandbox/linux/seccomp-bpf-helpers/syscall_paramete
 ===================================================================
 --- chromium-136.0.7103.48.orig/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
 +++ chromium-136.0.7103.48/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
-@@ -41,7 +41,7 @@
- #define MAP_DROPPABLE	0x08    // Zero memory under memory pressure.
+@@ -43,7 +43,7 @@
+ #define MAP_DROPPABLE 0x08  // Zero memory under memory pressure.
 #endif
 
 -#if BUILDFLAG(IS_LINUX) && !defined(__arm__) && !defined(__aarch64__) && \
@@ -631,3 +631,5 @@ Index: chromium-136.0.7103.48/sandbox/linux/services/syscall_wrappers.cc
   // CONFIG_CLONE_BACKWARDS defined.
   return syscall(__NR_clone, flags, child_stack, ptid, tls, ctid);
 #endif
+--- syscall_parameters_restrictions.cc	2025/10/01 15:32:29	1.1
+++ syscall_parameters_restrictions.cc	2025/10/01 15:32:47
--- a/ppc-fedora-Sandbox-linux-services-credentials.cc-PPC.patch
+++ b/ppc-fedora-Sandbox-linux-services-credentials.cc-PPC.patch
@@ -1,11 +1,11 @@
--- a/sandbox/linux/services/credentials.cc
-+++ b/sandbox/linux/services/credentials.cc
-@@ -87,7 +87,7 @@
-   alignas(16) char stack_buf[PTHREAD_STACK_MIN_CONST];
+--- chromium-141.0.7390.54/sandbox/linux/services/credentials.cc	2025/10/01 15:37:41	1.1
+++ chromium-141.0.7390.54/sandbox/linux/services/credentials.cc	2025/10/01 15:38:14
+@@ -85,7 +85,7 @@
+   alignas(16) std::array<char, PTHREAD_STACK_MIN_CONST> stack_buf;
 
 #if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \
 -    defined(ARCH_CPU_MIPS_FAMILY)
 +    defined(ARCH_CPU_MIPS_FAMILY) || defined(ARCH_CPU_PPC64_FAMILY)
-   // The stack grows downward.
-   void* stack = stack_buf + sizeof(stack_buf);
- #else
+   // SAFETY: This is the `stack` argument of `clone(2)`. Because the stack grows
+   // downward on these architectures, this is the topmost address of the memory
+   // space for the stack, and the address will not be dereferenced.
--- a/ppc-fedora-add-ppc64-architecture-to-extensions.diff
+++ b/ppc-fedora-add-ppc64-architecture-to-extensions.diff
@@ -2,11 +2,11 @@ Index: chromium-128.0.6613.113/chrome/browser/extensions/api/runtime/chrome_runt
 ===================================================================
 --- chromium-128.0.6613.113.orig/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate.cc
 +++ chromium-128.0.6613.113/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate.cc
-@@ -348,6 +348,8 @@
+@@ -375,6 +375,8 @@
     info->arch = extensions::api::runtime::PlatformArch::kMips64;
-   } else if (strcmp(arch, "riscv64") == 0) {
+   } else if (UNSAFE_TODO(strcmp(arch, "riscv64")) == 0) {
     info->arch = extensions::api::runtime::PlatformArch::kRiscv64;
-+  } else if (strcmp(arch, "ppc64") == 0) {
+  } else if (UNSAFE_TODO(strcmp(arch, "ppc64")) == 0) {
 +    info->arch = extensions::api::runtime::PlatformArch::kPpc64;
   } else {
     NOTREACHED();
--- a/ppc-fedora-fix-rustc.patch
+++ b/ppc-fedora-fix-rustc.patch
@@ -1,13 +0,0 @@
-diff -up chromium-131.0.6778.69/build/config/rust.gni.fix-rustc chromium-131.0.6778.69/build/config/rust.gni
--- chromium-131.0.6778.69/build/config/rust.gni.fix-rustc	2024-11-12 22:48:45.000000000 +0100
-+++ chromium-131.0.6778.69/build/config/rust.gni	2024-11-19 23:01:25.484436409 +0100
-@@ -200,6 +200,9 @@ if (is_linux || is_chromeos) {
-   if (current_cpu == "arm64") {
-     rust_abi_target = "aarch64-unknown-linux-gnu"
-     cargo_target_abi = ""
-+  } else if (current_cpu == "ppc64") {
-+    rust_abi_target = "powerpc64le-unknown-linux-gnu"
-+    cargo_target_abi = ""
-   } else if (current_cpu == "x86") {
-     rust_abi_target = "i686-unknown-linux-gnu"
-     cargo_target_abi = ""