+- `$(PROJECT_NAME)` : the name of the browser project, either `base-browser` or `tor-browser`

+**NOTE:** It is assumed the `tor-browser` rebase (stable and alpha) has already happened and there exists a `build1` build tags for both `base-browser` and `tor-browser` (stable and alpha)

+  - Create links to the relevant `gecko-dev`/other commit hashes which need to be backported OR a brief justification for why the fix does not need to be backported

+### CVEs

+

+<!-- CVE Resolution Template, foreach CVE to investigate add an entry in the form:

+- [ ] https://www.mozilla.org/en-US/security/advisories/mfsaYYYY-NN/#CVE-YYYY-XXXXX // CVE description

+  - https://bugzilla.mozilla.org/show_bug.cgi?id=NNNNNN // Bugzilla issue

+  - **Note** : Any relevant info about this fix, justification for why it is not necessary, etc

+  - **Patches**

+    - firefox-android : https://link.to/relevant/patch

+    - firefox : https://link.to/relevant/patch

+ -->

+  - [ ] Backport patches to `tor-browser` stable branch

+  - [ ] Open MR

+  - [ ] Merge

+  - [ ] Rebase patches onto:

+    - [ ] `base-browser` stable

+    - [ ] `tor-browser` alpha

+    - [ ] `base-browser` alpha

+  - [ ] Sign/Tag commits:

+    - Tag : `$(PROJECT_NAME)-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)`

+    - [ ] `base-browser` stable

+    - [ ] `tor-browser` stable

+    - [ ] `base-browser` alpha

+    - [ ] `tor-browser` alpha

+  - [ ] Push tags to `origin`

+  - [ ] Backport patches to `application-services` stable branch

+  - [ ] Open MR

+  - [ ] Merge

+  - [ ] Rebase patches onto `application-services` alpha

+  - [ ] Sign/Tag commits:

+    - [ ] `application-services` stable

+    - [ ] `application-services` alpha

+  - [ ] Push tags to `origin`

+  - [ ] Backport patches to `android-components` stable branch

+  - [ ] Open MR

+  - [ ] Merge

+  - [ ] Rebase patches onto `android-components` alpha

+  - [ ] Sign/Tag commits:

+    - [ ] `android-components` stable

+    - [ ] `android-components` alpha

+  - [ ] Push tags to `origin`

+  - [ ] Backport patches to `fenix` stable branch

+  - [ ] Open MR

+  - [ ] Merge

+  - [ ] Rebase patches onto `fenix` alpha

+  - [ ] Sign/Tag commits:

+    - [ ] `fenix` stable

+    - [ ] `fenix` alpha

+  - [ ] Push tags to `origin`

+### Update Branch Protection Rules

+

+- [ ] In [Repository Settings](https://gitlab.torproject.org/tpo/applications/tor-browser/-/settings/repository):

+  - [ ] Remove previous alpha `base-browser` and `tor-browser` branch protection rules (this will prevent pushing new changes to the branches being rebased)

+  - [ ] Create new `base-browser` and `tor-browser` branch protection rule:

+    - **Branch**: `*-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1*`

+      - example: `*-102.8.0esr-12.5-1*`

+    - **Allowed to merge**: `Maintainers`

+    - **Allowed to push and merge**: `Maintainers`

+    - **Allowed to force push**: `false`

+

+### **Create New Branches**

+

+- [ ] Create new alpha `base-browser` branch from Firefox mercurial tag (found during the stable rebase)

+  - branch name in the form: `base-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1`

+  - example: `base-browser-102.8.0esr-12.5-1`

+- [ ] Create new alpha `tor-browser` branch from Firefox mercurial tag

+  - branch name in the form: `tor-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1`

+  - example: `tor-browser-102.8.0esr-12.5-1`

+- [ ] Push new `base-browser` branch to `origin`

+- [ ] Push new `tor-browser` branch to `origin`

+

+- [ ] Checkout a new local branch for the `base-browser` rebase

+  - [ ] **(Optional)** Patch reordering

+    - Relocate new `base-browser` patches in the patch-set to enforce this rough thematic ordering:

+      - **MOZILLA BACKPORTS** - official Firefox patches we have backported to our ESR branch: Android-specific security updates, critical bug fixes, worthwhile features, etc

+      - **MOZILLA REVERTS** - revert commits of official Firefox patches

+      - **UPLIFT CANDIDATES** - patches which stand on their own and should be uplifted to `mozilla-central`

+      - **BUILD CONFIGURATION** - tools/scripts, gitlab templates, etc

+      - **BROWSER CONFIGURATION** - branding, mozconfigs, preference overrides, etc

+      - **SECURITY PATCHES** - security improvements, hardening, etc

+      - **PRIVACY PATCHES** - fingerprinting, linkability, proxy bypass, etc

+      - **FEATURES** - new functionality: updater, UX, letterboxing, security level, add-on integration, etc

+  - [ ] **(Optional)** Patch reordering

+    - Relocate new `tor-browser` patches in the patch-set to enforce this rough thematic ordering:

+      - **BUILD CONFIGURATION** - tools/scripts, gitlab templates, etc

+      - **BROWSER CONFIGURATION** - branding, mozconfigs, preference overrides, etc

+      - **UPDATER PATCHES** - updater tweaks, signing keys, etc

+      - **SECURITY PATCHES** - non tor-dependent security improvements, hardening, etc

+      - **PRIVACY PATCHES** - non tor-dependent fingerprinting, linkability, proxy bypass, etc

+      - **FEAURES** - non tor-dependent features

+      - **TOR INTEGRATION** - legacy tor-launcher/torbutton, tor modules, bootstrapping, etc

+      - **TOR SECURITY PATCHES** - tor-specific security improvements

+      - **TOR PRIVACY PATCHES** - tor-specific privacy improvements

+      - **TOR FEATURES** - new tor-specific functionality: manual, onion-location, onion service client auth, etc

+- [ ] Rebase and autosquash again (from the last new `base-browser` commit to `HEAD`), this time replacing all `fixup` and `squash` commands with `pick`. The goal here is to have all of the `fixup` and `squash` commits beside the commit which they modify.

+  - example: `git rebase --autosquash --interactive base-browser-102.8.0esr-12.5-1-build1 HEAD`

+  - **NOTE**: Do not allow `fixup` or `squash` commands here!

+      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456` (unless the previous `base-browser` branch includes changes not included in the previous `tor-browser` branch)

+### Update Branch Protection Rules

+

+- [ ] In [Repository Settings](https://gitlab.torproject.org/tpo/applications/tor-browser/-/settings/repository):

+  - [ ] Remove previous stable `base-browser` and `tor-browser` branch protection rules (this will prevent pushing new changes to the branches being rebased)

+  - [ ] Create new `base-browser` and `tor-browser` branch protection rule:

+    - **Branch**: `*-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1*`

+      - example: `*-102.8.0esr-12.0-1*`

+    - **Allowed to merge**: `Maintainers`

+    - **Allowed to push and merge**: `Maintainers`

+    - **Allowed to force push**: `false`

+

+- [ ] Checkout a new local branch for the `base-browser` rebase

+

+      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456` (unless the previous `base-browser` branch includes changes not included in the previous `tor-browser` branch)

+// tor-browser#41417: do not allow live reload until we switch to Fluent and

+// stop using .textContent.

+pref("intl.multilingual.liveReload", false);

+

+/**

+ * The current version for base browser.

+ */

+var kVersionBaseBrowser = 1;

+

+/**

+ * The current version for tor browser.

+ */

+var kVersionTorBrowser = 1;

+

+    this._updateForBaseBrowser();

+    this._updateForTorBrowser();

+      // Don't want springs either side of the urlbar. tor-browser#41736

+      // save-to-pocket-button is entirely disabled. See tor-browser#18886 and

+      // tor-browser#31602.

+      // Base-browser additions tor-browser#41736. If you want to add to, remove

+      // from, or rearrange this list, then bump the kVersionBaseBrowser and

+      // update existing saved states in _updateForBaseBrowser.

+      // Or if the change is only meant for tor-browser, bump kVersionTorBrowser

+      // instead and update the existing saved states in _updateForTorBrowser.

+      "security-level-button",

+      "new-identity-button",

+    // navbarPlacements does not match the initial default XHTML layout.

+    // Therefore we always need to rebuild the navbar area when

+    // registerToolbarNode is called. tor-browser#41736

+    gDirtyAreaCache.add(CustomizableUI.AREA_NAVBAR);

+  _updateForBaseBrowser() {

+    if (!gSavedState) {

+      // Use the defaults.

+      return;

+    }

+

+    const currentVersion = gSavedState.currentVersionBaseBrowser;

+

+    if (currentVersion < 1) {

+      // NOTE: In base-browser/tor-browser version 12.5a5, and earlier, the

+      // toolbar was configured by setting the full JSON string for the default

+      // "browser.uiCustomization.state" preference value. The disadvantage is

+      // that we could not update this value in a way that existing users (who

+      // would have non-default preference values) would also get the desired

+      // change (e.g. for adding or removing a button).

+      //

+      // With tor-browser#41736 we want to switch to changing the toolbar

+      // dynamically like firefox. Therefore, this first version transfer simply

+      // gets the toolbar into the same state we wanted before, away from the

+      // default firefox state.

+      //

+      // If an existing user state aligned with the previous default

+      // "browser.uiCustomization.state" then this shouldn't visibly change

+      // anything.

+      // If a user explicitly customized the toolbar to go back to the firefox

+      // default, then this may undo those changes.

+      const navbarPlacements =

+        gSavedState.placements[CustomizableUI.AREA_NAVBAR];

+      if (navbarPlacements) {

+        const getBeforeAfterUrlbar = () => {

+          // NOTE: The urlbar is non-removable from the navbar, so should have

+          // an index.

+          const index = navbarPlacements.indexOf("urlbar-container");

+          let after = index + 1;

+          if (

+            after < navbarPlacements.length &&

+            navbarPlacements[after] === "search-container"

+          ) {

+            // Skip past the search-container.

+            after++;

+          }

+          return { before: index - 1, after };

+        };

+

+        // Remove the urlbar springs either side of the urlbar.

+        const { before, after } = getBeforeAfterUrlbar();

+        if (

+          after < navbarPlacements.length &&

+          this.matchingSpecials(navbarPlacements[after], "spring")

+        ) {

+          // Remove the spring after.

+          navbarPlacements.splice(after, 1);

+          // NOTE: The `before` index does not change.

+        }

+        if (

+          before >= 0 &&

+          this.matchingSpecials(navbarPlacements[before], "spring")

+        ) {

+          // Remove the spring before.

+          navbarPlacements.splice(before, 1);

+        }

+

+        // Make sure the security-level-button and new-identity-button appears

+        // in the toolbar.

+        for (const id of ["new-identity-button", "security-level-button"]) {

+          let alreadyAdded = false;

+          for (const placements of Object.values(gSavedState.placements)) {

+            if (placements.includes(id)) {

+              alreadyAdded = true;

+              break;

+            }

+          }

+          if (alreadyAdded) {

+            continue;

+          }

+

+          // Add to the nav-bar, after the urlbar-container.

+          // NOTE: We have already removed the spring after the urlbar.

+          navbarPlacements.splice(getBeforeAfterUrlbar().after, 0, id);

+        }

+      }

+

+      // Remove save-to-pocket-button. See tor-browser#18886 and

+      // tor-browser#31602.

+      for (const placements of Object.values(gSavedState.placements)) {

+        let buttonIndex = placements.indexOf("save-to-pocket-button");

+        if (buttonIndex != -1) {

+          placements.splice(buttonIndex, 1);

+        }

+      }

+

+      // Remove unused fields that used to be part of

+      // "browser.uiCustomization.state".

+      delete gSavedState.placements["PanelUI-contents"];

+      delete gSavedState.placements["addon-bar"];

+    }

+  },

+

+  _updateForTorBrowser() {

+    if (!gSavedState) {

+      // Use the defaults.

+      return;

+    }

+

+    const currentVersion = gSavedState.currentVersionTorBrowser;

+

+    if (currentVersion < 1) {

+      // Remove torbutton-button, which no longer exists.

+      for (const placements of Object.values(gSavedState.placements)) {

+        let buttonIndex = placements.indexOf("torbutton-button");

+        if (buttonIndex != -1) {

+          placements.splice(buttonIndex, 1);

+        }

+      }

+    }

+  },

+

+    if (!("currentVersionBaseBrowser" in gSavedState)) {

+      gSavedState.currentVersionBaseBrowser = 0;

+    }

+

+    if (!("currentVersionTorBrowser" in gSavedState)) {

+      gSavedState.currentVersionTorBrowser = 0;

+    }

+

+      currentVersionBaseBrowser: kVersionBaseBrowser,

+      currentVersionTorBrowser: kVersionTorBrowser,

+    // The extension ID for NoScript (WebExtension)

+    const isNoScript =

+      this.extension.id === "{73a6fe31-595d-460b-a920-fcc0f8843232}";

+

+      // Do not want to add the NoScript extension to the toolbar by default.

+      // tor-browser#41736

+      defaultArea: isNoScript

+        ? null

+        : browserAreas[this.action.getDefaultArea()],

+      case "live-reload":

+        Services.locale.requestedLocales = newLocales;

+        gMainPane.updatePrimaryBrowserLanguageUI(

+          Services.locale.appLocaleAsBCP47

+        );

+        gMainPane.hideConfirmLanguageChangeMessageBar();

+        break;

+      case "live-reload":

+        Services.locale.requestedLocales = selected;

+

+        gMainPane.updatePrimaryBrowserLanguageUI(

+          Services.locale.appLocaleAsBCP47

+        );

+        gMainPane.hideConfirmLanguageChangeMessageBar();

+        break;

+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">

+<path fill-rule="evenodd" clip-rule="evenodd" d="M10.5994 2.89744C9.52191 2.34851 8.2983 2.15477 7.10392 2.34398C6.64247 2.41708 6.19453 2.5459 5.76923 2.72578C5.82159 2.91042 5.84961 3.10529 5.84961 3.3067C5.84961 4.48031 4.89821 5.4317 3.72461 5.4317C2.551 5.4317 1.59961 4.48031 1.59961 3.3067C1.59961 2.1331 2.551 1.1817 3.72461 1.1817C4.23757 1.1817 4.70808 1.36346 5.07525 1.66608C5.65429 1.3987 6.27072 1.21038 6.90834 1.10937C8.36342 0.878863 9.85413 1.11489 11.1668 1.78364C12.4795 2.45239 13.5468 3.51953 14.2158 4.83212C14.8848 6.14471 15.121 7.63538 14.8907 9.0905C14.8368 9.43143 14.5167 9.66408 14.1757 9.61013C13.8348 9.55617 13.6022 9.23605 13.6561 8.89511C13.8451 7.70071 13.6512 6.47713 13.1021 5.39971C12.553 4.3223 11.6769 3.44636 10.5994 2.89744ZM4.64961 3.3067C4.64961 3.81756 4.23547 4.2317 3.72461 4.2317C3.21375 4.2317 2.79961 3.81756 2.79961 3.3067C2.79961 2.79584 3.21375 2.3817 3.72461 2.3817C4.23547 2.3817 4.64961 2.79584 4.64961 3.3067Z" fill="context-fill"/>

+<path fill-rule="evenodd" clip-rule="evenodd" d="M1.82421 6.38991C2.16514 6.44387 2.39779 6.76399 2.34383 7.10492C2.15482 8.29933 2.34875 9.52291 2.89785 10.6003C3.44695 11.6777 4.32303 12.5537 5.40053 13.1026C6.47803 13.6515 7.70165 13.8453 8.89602 13.6561C9.35628 13.5831 9.8031 13.4548 10.2274 13.2757C10.1734 13.0884 10.1445 12.8906 10.1445 12.686C10.1445 11.5124 11.0959 10.561 12.2695 10.561C13.4431 10.561 14.3945 11.5124 14.3945 12.686C14.3945 13.8596 13.4431 14.811 12.2695 14.811C11.7602 14.811 11.2927 14.6318 10.9267 14.333C10.3471 14.6009 9.72997 14.7895 9.0916 14.8907C7.63652 15.1212 6.14581 14.8851 4.83311 14.2164C3.52042 13.5476 2.45311 12.4805 1.78415 11.1679C1.11519 9.85533 0.878921 8.36466 1.1092 6.90954C1.16315 6.56861 1.48327 6.33596 1.82421 6.38991ZM13.1945 12.686C13.1945 13.1968 12.7804 13.611 12.2695 13.611C11.7587 13.611 11.3445 13.1968 11.3445 12.686C11.3445 12.1751 11.7587 11.761 12.2695 11.761C12.7804 11.761 13.1945 12.1751 13.1945 12.686Z" fill="context-fill"/>

+static const char* const kPinset_tor_browser_Data[] = {

+  kISRG_Root_X1Fingerprint,

+};

+static const StaticFingerprints kPinset_tor_browser = {

+  sizeof(kPinset_tor_browser_Data) / sizeof(const char*),

+  kPinset_tor_browser_Data

+};

+

+  { "bridges.torproject.org", false, false, false, -1, &kPinset_tor_browser },