chore: upgrade Chromium from v126 to v143 for asset discovery

.github/.cache-key

@@ -6,5 +6,5 @@
               ;   ;
               /   \
 _____________/_ __ \_____________
-Times we have broken CI: 3
+Times we have broken CI: 4
 Times Windows has broken CI: 99+

packages/core/src/browser.js

@@ -20,8 +20,15 @@ export class Browser extends EventEmitter {
   #lastid = 0;
 
   args = [
-    // disable the translate popup and optimization downloads
-    '--disable-features=Translate,OptimizationGuideModelDownloading',
+    // disable: translate popup, optimization downloads, baseline site
+    // isolation (so cross-origin sub-resources and worker fetches stay in
+    // the main renderer for interception), HTTPS-first navigation blocking,
+    // and Local Network Access permission checks (Chrome 143+ blocks
+    // sub-resource requests to *.localhost / 127.0.0.1 / RFC1918 with
+    // `LocalNetworkAccessPermissionDenied` when the document was served
+    // via Fetch.fulfillRequest from asset discovery — there is no permission
+    // prompt available in headless to grant the access).
+    '--disable-features=Translate,OptimizationGuideModelDownloading,IsolateOrigins,site-per-process,HttpsFirstBalancedModeAutoEnable,LocalNetworkAccessChecks',
     // disable several subsystems which run network requests in the background
     '--disable-background-networking',
     // disable task throttling of timer tasks from background pages

packages/core/src/install.js

@@ -175,13 +175,13 @@ export function chromium({
   });
 }
 
-// default chromium revisions corresponds to v126.0.6478.184
+// default chromium revisions corresponds to v143.0.7499.169
 chromium.revisions = {
-  linux: '1300309',
-  win64: '1300297',
-  win32: '1300295',
-  darwin: '1300293',
-  darwinArm: '1300314'
+  linux: '1536366',
+  win64: '1536376',
+  win32: '1536377',
+  darwin: '1536380',
+  darwinArm: '1536376'
 };
 
 // export the namespace by default

packages/core/src/network.js

@@ -558,7 +558,7 @@ async function makeDirectRequest(network, request, session) {
     'sec-fetch-site': 'same-origin',
     'sec-fetch-mode': 'cors',
     'sec-fetch-dest': 'font',
-    'sec-ch-ua': '"Chromium";v="123", "Google Chrome";v="123", "Not?A_Brand";v="99"',
+    'sec-ch-ua': '"Chromium";v="143", "Google Chrome";v="143", "Not?A_Brand";v="99"',
     'sec-ch-ua-mobile': '?0',
     'sec-ch-ua-platform': '"macOS"',
     'sec-fetch-user': '?1',

packages/core/test/helpers/server.js

@@ -28,6 +28,12 @@ export function createTestServer({ default: defaultReply, ...replies }, port = 8
   server.route(async (req, res, next) => {
     let pathname = req.url.pathname;
     if (req.url.search) pathname += req.url.search;
+    // Chrome >=128 new headless auto-requests /favicon.ico for every navigation.
+    // Reply 204 so the browser doesn't capture it as a snapshot resource, and
+    // skip it from the requests log so per-test request assertions stay stable.
+    if (req.url.pathname === '/favicon.ico') {
+      return res.writeHead(204).end();
+    }
     server.requests.push(req.body ? [pathname, req.body, req.headers] : [pathname, req.headers]);
     let reply = replies[pathname] || defaultReply;
     return reply ? await reply(req, res) : next();

packages/core/test/snapshot.test.js

@@ -1535,10 +1535,13 @@ describe('Snapshot', () => {
 
       await percy.idle();
 
+      // srcdoc HTML attribute serialization: pre-Chrome-128 left `<` `>` literal
+      // inside attribute values; Chrome >=128 entity-escapes them per HTML5 spec.
+      // Accept either form.
       expect(Buffer.from((
         api.requests['/builds/123/resources'][0]
           .body.data.attributes['base64-content']
-      ), 'base64').toString()).toMatch(/<iframe.*srcdoc=".*<p>Foo<\/p>/);
+      ), 'base64').toString()).toMatch(/<iframe.*srcdoc=".*(?:<p>Foo<\/p>|&lt;p&gt;Foo&lt;\/p&gt;)/);
     });
 
     it('errors if execute cannot be serialized', async () => {