[iceweasel]: upgrade to v114.0

1. Update according to the changes from upstreams.
2. To build, needed to copy 'document.ico' from 'unofficial' branding
   folder. I believe it has no trademarks attached to it and is OK for
Parabola as it appears to have no special license notice, meaning it's
MPL-2.0 as is most of the Firefox code. Ideally, it'd be better to
remove the wireframe sphere logo from the center and replace it with
Iceweasel logo, and that's what I did initially. But after some digging
into license compatibility of MPL-2.0 and multi-license of Iceweasel
logo (MPL 1.1/GPL 2.0/LGPL 2.1), and reading recommendations to consult
with a lawyer for this case (combining modified works), I decided that's
too much of a hassle.
2. FSDG: Disable and remove URLs of Contile and autoupdate of system
   addons.
3. Remove dependencies to old versions of python and python-pydantic,
   since system python-typing-extensions can be used instead of vendored
one (after removal of it from the source tree in prepare()).
4. Bring back the patch for version constraint of python-zstandard to
   depend on current system version.

6 files changed, 149 insertions, 81 deletions

diff --git a/libre/iceweasel/9001-FSDG-sync-remote-settings-with-local-dump.patch b/libre/iceweasel/9001-FSDG-sync-remote-settings-with-local-dump.patch
index 9c3323aec..96a8b615b 100644
--- a/libre/iceweasel/9001-FSDG-sync-remote-settings-with-local-dump.patch
+++ b/libre/iceweasel/9001-FSDG-sync-remote-settings-with-local-dump.patch
@@ -24,7 +24,7 @@ If necessary, missing files can be added later.
 ---
  .../components/ASRouterAdmin/ASRouterAdmin.jsx            | 2 +-
  .../newtab/data/content/activity-stream.bundle.js         | 2 +-
- services/settings/Utils.jsm                               | 2 +-
+ services/settings/Utils.sys.mjs                               | 2 +-
  .../periodic-updates/scripts/periodic_file_updates.sh     | 2 +-
  .../components/antitracking/docs/query-stripping/index.md | 2 +-
  .../backgroundtasks/BackgroundTask_message.sys.mjs        | 4 ++--
@@ -61,10 +61,10 @@ index 87cb0f624c..1cf1012f29 100644
            rel: "noopener noreferrer"
          }, "nimbus-desktop-experiments"), ")");
        }
-diff --git a/services/settings/Utils.jsm b/services/settings/Utils.jsm
+diff --git a/services/settings/Utils.sys.mjs b/services/settings/Utils.sys.mjs
 index 94f4713380..3a8165f878 100644
---- a/services/settings/Utils.jsm
-+++ b/services/settings/Utils.jsm
+--- a/services/settings/Utils.sys.mjs
++++ b/services/settings/Utils.sys.mjs
 @@ -108,7 +108,7 @@ var Utils = {
        : AppConstants.REMOTE_SETTINGS_SERVER_URL;
    },
@@ -319,7 +319,7 @@ timestamps from that file and mock response headers to not confuse any
 code that expects them.
 ---
  browser/installer/package-manifest.in     |  1 +
- services/settings/Utils.jsm               | 28 ++++++++++++++++++++---
+ services/settings/Utils.sys.mjs               | 28 ++++++++++++++++++++---
  services/settings/dumps/monitor/moz.build |  8 +++++++
  services/settings/dumps/moz.build         |  1 +
  4 files changed, 35 insertions(+), 3 deletions(-)
@@ -337,10 +337,10 @@ index 8caff8de94..1e53e074c9 100644
  @RESPATH@/browser/defaults/settings/security-state
  
  ; Warning: changing the path to channel-prefs.js can cause bugs (Bug 756325)
-diff --git a/services/settings/Utils.jsm b/services/settings/Utils.jsm
+diff --git a/services/settings/Utils.sys.mjs b/services/settings/Utils.sys.mjs
 index 3a8165f878..90922cc6ff 100644
---- a/services/settings/Utils.jsm
-+++ b/services/settings/Utils.jsm
+--- a/services/settings/Utils.sys.mjs
++++ b/services/settings/Utils.sys.mjs
 @@ -377,7 +377,7 @@ var Utils = {
    async fetchLatestChanges(serverUrl, options = {}) {
      const { expectedTimestamp, lastEtag = "", filters = {} } = options;
@@ -428,13 +428,13 @@ Subject: [PATCH 05/13] Utils: disable offline checking
 Since only local data is read now, it should always return false for the
 current and any future code that relies on it.
 ---
- services/settings/Utils.jsm | 10 ----------
+ services/settings/Utils.sys.mjs | 10 ----------
  1 file changed, 10 deletions(-)
 
-diff --git a/services/settings/Utils.jsm b/services/settings/Utils.jsm
+diff --git a/services/settings/Utils.sys.mjs b/services/settings/Utils.sys.mjs
 index 90922cc6ff..a4a578a73a 100644
---- a/services/settings/Utils.jsm
-+++ b/services/settings/Utils.jsm
+--- a/services/settings/Utils.sys.mjs
++++ b/services/settings/Utils.sys.mjs
 @@ -191,16 +191,6 @@ var Utils = {
     * @return {bool} Whether network is down or not.
     */
@@ -783,10 +783,10 @@ noticeable performance issues.
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/services/settings/RemoteSettingsClient.sys.mjs b/services/settings/RemoteSettingsClient.sys.mjs
-index 5cc577ea8f..833400d047 100644
+index e19cece909..39d5c239bf 100644
 --- a/services/settings/RemoteSettingsClient.sys.mjs
 +++ b/services/settings/RemoteSettingsClient.sys.mjs
-@@ -18,6 +18,7 @@ ChromeUtils.defineESModuleGetters(lazy, {
+@@ -20,6 +20,7 @@ ChromeUtils.defineESModuleGetters(lazy, {
  });
  
  XPCOMUtils.defineLazyModuleGetters(lazy, {
diff --git a/libre/iceweasel/9002-FSDG-preference-defaults.patch b/libre/iceweasel/9002-FSDG-preference-defaults.patch
index 1804afa9c..323240ce9 100644
--- a/libre/iceweasel/9002-FSDG-preference-defaults.patch
+++ b/libre/iceweasel/9002-FSDG-preference-defaults.patch
@@ -208,3 +208,52 @@ index 5ec8703f29..48e92b1478 100644
  pref("extensions.recommendations.privacyPolicyUrl", "");
 -- 
 2.39.0
+
+From bb913b7f286927f544af064e3ba7cc403163b671 Mon Sep 17 00:00:00 2001
+From: grizzlyuser <grizzlyuser@protonmail.com>
+Date: Sun, 4 Jun 2023 13:16:40 +0200
+Subject: [PATCH] FSDG: Disable Contile and autoupdate of system addons
+
+1. Contile (see change context lines) is used to fetch sponsored top
+   sites, which are not controlled by Parabola and are likely to not
+be committed to include only free software.
+2. While system addons shipped in the source code seem to be free
+   software, I'm not sure if the update endpoint also returns only free
+software, given that Mozilla is not committed to include only free
+software in their repositories.
+
+As these URLs can be considered as repositories not committed to include
+only free software, remove them from the source code.
+---
+ browser/app/profile/firefox.js | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
+index 3f133f4ee5..1676441784 100644
+--- a/browser/app/profile/firefox.js
++++ b/browser/app/profile/firefox.js
+@@ -51,8 +51,8 @@ pref("extensions.recommendations.themeRecommendationUrl", "https://color.firefox
+ pref("extensions.update.autoUpdateDefault", true);
+ 
+ // Check AUS for system add-on updates.
+-pref("extensions.systemAddon.update.url", "https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml");
+-pref("extensions.systemAddon.update.enabled", true);
++pref("extensions.systemAddon.update.url", "");
++pref("extensions.systemAddon.update.enabled", false);
+ 
+ // Disable add-ons that are not installed by the user in all scopes by default.
+ // See the SCOPE constants in AddonManager.jsm for values to use here.
+@@ -1523,8 +1523,8 @@ pref("prompts.defaultModalType", 3);
+ 
+ pref("browser.topsites.useRemoteSetting", true);
+ // Fetch sponsored Top Sites from Mozilla Tiles Service (Contile)
+-pref("browser.topsites.contile.enabled", true);
+-pref("browser.topsites.contile.endpoint", "https://contile.services.mozilla.com/v1/tiles");
++pref("browser.topsites.contile.enabled", false);
++pref("browser.topsites.contile.endpoint", "");
+ 
+ // The base URL for the Quick Suggest anonymizing proxy. To make a request to
+ // the proxy, include a campaign ID in the path.
+-- 
+2.41.0
+
diff --git a/libre/iceweasel/9004-FSDG-misc.patch b/libre/iceweasel/9004-FSDG-misc.patch
index 2e74686a2..4d2680c6a 100644
--- a/libre/iceweasel/9004-FSDG-misc.patch
+++ b/libre/iceweasel/9004-FSDG-misc.patch
@@ -259,18 +259,18 @@ index f6dc2b3781..34c7d8c528 100644
    // registered and inititalized since many tests wait for the
    // "sync-pane-loaded" observer notification before starting the test.
 diff --git a/browser/components/preferences/preferences.xhtml b/browser/components/preferences/preferences.xhtml
-index 81059f3d2e..be23729276 100644
+index 37544d2092..32b95bf95e 100644
 --- a/browser/components/preferences/preferences.xhtml
 +++ b/browser/components/preferences/preferences.xhtml
-@@ -33,7 +33,6 @@
-   <link rel="localization" href="browser/branding/sync-brand.ftl"/>
+@@ -31,7 +31,6 @@
    <link rel="localization" href="browser/browser.ftl"/>
-   <link rel="localization" href="browser/preferences/preferences.ftl"/>
--  <link rel="localization" href="browser/preferences/moreFromMozilla.ftl"/>
-   <!-- Used by fontbuilder.js -->
+     <!-- Used by fontbuilder.js -->
    <link rel="localization" href="browser/preferences/fonts.ftl"/>
-   <link rel="localization" href="toolkit/featuregates/features.ftl"/>
-@@ -152,16 +151,6 @@
+-  <link rel="localization" href="browser/preferences/moreFromMozilla.ftl"/>
+   <link rel="localization" href="browser/preferences/preferences.ftl"/>
+   <link rel="localization" href="locales-preview/translations.ftl"/>
+   <link rel="localization" href="toolkit/branding/accounts.ftl"/>
+@@ -156,16 +155,6 @@
            <image class="category-icon"/>
            <label class="category-name" flex="1" data-l10n-id="pane-experimental-title"></label>
          </richlistitem>
diff --git a/libre/iceweasel/PKGBUILD b/libre/iceweasel/PKGBUILD
index e4aa8973b..ecc4fbc1e 100644
--- a/libre/iceweasel/PKGBUILD
+++ b/libre/iceweasel/PKGBUILD
@@ -70,7 +70,7 @@
 
 pkgname=iceweasel
 epoch=1
-pkgver=113.0.2
+pkgver=114.0
 pkgrel=1
 pkgrel+=.parabola1
 _brandingver=112.0
@@ -162,6 +162,7 @@ source+=(
   9004-FSDG-misc.patch
   process-json-files.py
   vendor.js.in
+  zstandard-0.21.0.diff
 )
 source_armv7h=(build-arm-libopus.patch)
 source_i686=(
@@ -178,34 +179,36 @@ validpgpkeys+=(
   'BFA8008A8265677063B11BF47171986E4B745536' # Andreas Grapentin
   '3954A7AB837D0EA9CFA9798925DB7D9B5A8D4B40' # bill-auger
 )
-sha256sums=('f132b702836311b6cc40873b69df3ce208d035dbc8ce390c390eebd63d27c7a3'
+sha256sums=('d23a0502742f52110ce496837ba82b47bf38d40585633787508ae5be9a5b4bc6'
             'SKIP'
             '9cdc2602661717712092d28bb494e5b48e518cb930898aca85eaf21f91f7ef58')
 sha256sums+=('a44dc1e9f2d508203d1cacc2b5bb212c73eb04311da9a036560ff389d7b8e9e6'
              'SKIP'
-             '63245fa00363d8884aa2b62fbade557cbe72c5cb326303c7d3f7664e0e3e359c'  # 9001-FSDG-sync-remote-settings-with-local-dump.patch
-             '1e4d28bd87688334b20cce9213490111e004ea6bcf1654f550da8ebe6bdbf3ef'  # 9002-FSDG-preference-defaults.patch
+             '5c698551b1170e4bbf6e079c82ff0ccdc5266d87678b0653623dea5ec124d09a'  # 9001-FSDG-sync-remote-settings-with-local-dump.patch
+             '131acdeff2af06c07f245717cd7cb898291f4466136f441b7b90acb2ccdade0a'  # 9002-FSDG-preference-defaults.patch
              '13b701372b6fb35b96a1d58853db64643feb9be061ebc461b41ceca5de8eea62'  # 9003-FSDG-urihandlers.patch
-             '44eeea69361ee4b9e4814452ed7e59f1caf2280688316dfdfe3e8b0f5da35798'  # 9004-FSDG-misc.patch
+             'f2775f40dec9849b318f290c91f34c608ebbe274044fec9b05a485536e7041c0'  # 9004-FSDG-misc.patch
              '00cb44a91b42942f17258ad165810866ff123777b667a5691ea0745ba72f4332'  # process-json-files.py
-             '8e113fd2730be3fd11b2a24918dd62e8741513cf4dce9819d8eae358c5411adc') # vendor.js.in
+             '8e113fd2730be3fd11b2a24918dd62e8741513cf4dce9819d8eae358c5411adc'  # vendor.js.in
+             'aa663d899e924f4979114584cad671dad3b93dd9b0dfe28bb1cf11ddf92e6d47') # zstandard-0.21.0.diff
 sha256sums_armv7h=('2d4d91f7e35d0860225084e37ec320ca6cae669f6c9c8fe7735cdbd542e3a7c9')
 sha256sums_i686=('2f0c81a38c4578f68f5456b618fe84a78974072821488173eb55e0e72287e353'
                  '10c5276eab2e87f400a6ec15d7ffbef3b0407ee888dea36f1128927ca55b9041'
                  'ed3bb281697af7c4353a34067ffb4b18a971d40757bef2d6af3c8bf2d28d42d1'
                  '2fb39374fd3d80eea9e346032a2a4b2bc2e357dee7380855b24bcf19b1335d06'
                  'c3ce181fbb0142055aa6dd17f3cda2ba6a1e54d7a689a8c6e9cce76aa40e6544')
-b2sums=('29be5865db0fd5de0d74d8f906301277eb3eeb0ef53db0a27398a0410fd2b8f973074cf58e00c718b5c7ef2b71295513adc1a905444e8b74f5b9be3a701d9b6d'
+b2sums=('09d29112a487bc23c0e54380bf5e6ef5c62639aa53b6cca7c9a61b2452f4ee0e1a1b9f7ca996ddb78b842170fa67be0dc926c17956ab505e42966d443a798f34'
         'SKIP'
         'f86353bbba05d8994db34c6abb66094aa61d2c37c8599930dbe9d215413f0f718a1ce55a8f2d07a65074c3947e28fc80d44c925bd9be239a870f82d2a1803635')
 b2sums+=('8472a10e5e27cc82f1467dd6592dfee512cd165e39f23ebbb4c8e76bbf6fd8614a4c1f1d91d42046f773eb711f463ece1aa23e1b1882173290529c28b0f3b60a'
          'SKIP'
-         'ba9530d65871a84fdfd121c2ee13ce9f80d65e1f7cd23be7ea9fc232822601c9f7428c15e08e971f0d24791d93290945ecee55de99e6c2b64f8cdc6d2806b564'  # 9001-FSDG-sync-remote-settings-with-local-dump.patch
-         'bdb08d681f6f17ae9f8e0bb37e23087a0401d4be26c91ead3eda4654362ad37c3b1cddf69596e2b2278f77e0fd45714b7dbb7a97aca35aae5417e916079d24bf'  # 9002-FSDG-preference-defaults.patch
+         '9bd51af60740fcbf31b8387901d73c09dbc2f15ddd98d18f4c90ee909f58c9a8fe032712679c36d0c52358dad34c68b539695fccb019b4c35859673a724c3f72'  # 9001-FSDG-sync-remote-settings-with-local-dump.patch
+         'fc2204d183cf8ef133cb94580a92db26356edb069424e751743b2af349f115fb6069f0e3fe860496e05193cb0ca3dcb9aa5869c86d5c96c05a6eaec5242f8a35'  # 9002-FSDG-preference-defaults.patch
          '9e4ccfb8850d9f9a5222f5186b35f2ae7986b6c6d435de024b109a6fa01e65a1362664cfb6ea81621387cf33364cc8d3d466fae1bee24ab5fc7e23c4cb17bf2c'  # 9003-FSDG-urihandlers.patch
-         '82224f03e7688daebed3b70959206d2aa4758212f2982e9847862617a5a4005be29493fcd44066604f421ebec6b8c94dcf0cfbf03d0c3d670f00d5192d2421d7'  # 9004-FSDG-misc.patch
+         '7ce9bd437d2877545f71a2f258b94f4c3e4107dbb65957ea544b2ae915dd2f783ea1473354608097425e5245d76ea51c8993ddeffebd6aeca6e23711415bbf93'  # 9004-FSDG-misc.patch
          '085c4631ec8cfdf5842068d882185c783e976b1fde74167bb71ef4d7db8c70c12844177b17e76f858ba3ce2a402848ac8fc19910dcbefd29887abfaf5faac5e4'  # process-json-files.py
-         '5302b6abcfec3155c578e0664e6a0ac921234c5912d74c4a9b0feb3a051ed4ef5f11b93ee37739a3a92fc6693683374f92ac9c3f560780f879c4249d0718157a') # vendor.js.in
+         '5302b6abcfec3155c578e0664e6a0ac921234c5912d74c4a9b0feb3a051ed4ef5f11b93ee37739a3a92fc6693683374f92ac9c3f560780f879c4249d0718157a'  # vendor.js.in
+         '2e568bb28f23f0f9225ca68a5084e3e835f6bd15046eea9d615d3462146da649c1b6b7439b4d768759bda2658d54ca73c9b3479e5e0b6d7a58822664dbe45aa2') # zstandard-0.21.0.diff
 b2sums_armv7h=('6e5980e56343a23bce4fcda58f6abc8f2debca0c278c87b09e53abb17ff15849c26e8df3bbff2388985f8fe5a4e9be9982c602ef7159546f0ae335fca1000a41')
 b2sums_i686=('97035e44cd1deae7bb2422c81eec7294feb51f43f460b4d7ddba083e1d8a48d265a36ca43cf1d9dee49b01ee6df0c76e0f6916cc73cb7ad9caa1c235a59da0e4'
              '009789d3bb93ba418929019135804fc3de7de161e5be8efba7fc75646fbde395720be5b7a7d3f5d1671f459fdd2944dd14aca306bbf1c975436d4f7765d62d15'
@@ -242,10 +245,6 @@ readonly _SHOULD_USE_GCC=$(case "${CARCH}" in armv7h) echo 1 ;; *) echo 0 ;; esa
 
 ## dependency tweaks ##
 
-makedepends+=( python-pydantic=1.9.2   ) # dustbin - configure error: pydantic 1.10.4 has requirement typing-extensions>=4.2.0, but you have typing-extensions 3.10.0.0
-makedepends+=( python-zstandard=0.19.0 ) # dustbin - configure error: zstandard<=0.19.0,>=0.11.1: Installed with unexpected version "0.20.0"
-makedepends+=( python=3.10.10          ) # dustbin - to support 'python-pydantic' above
-
 case "${CARCH}" in
 armv7h)
   makedepends=( ${makedepends[*]/wasi-*/} ) # armv7h has no wasi compiler
@@ -337,6 +336,15 @@ prepare() {
 
   ## technical patching ##
 
+  # Unbreak build with python-zstandard 0.21.0
+  echo "applying zstandard-0.21.0.diff"
+  patch -Np1 -i ../zstandard-0.21.0.diff
+
+  # Use system python-typing-extensions instead of the old vendored one to avoid
+  # unresolvable dependency versions. They are probably downloaded when network
+  # connectivity is enabled at built time, but that is not the case for Parabola.
+  rm -rfv third_party/python/typing_extensions
+
   # arch-specific technical patching
   case ${CARCH} in
   aarch64|armv7h)
@@ -564,14 +572,15 @@ END
   for size in 16 22 24 32 48 64 128 256
   do  rsvg-convert -w ${size} -h ${size}  iceweasel_icon.svg -o default${size}.png
   done
-  cp                                      iceweasel_logo.svg        content/aboutlogins.svg
-  cp                                      iceweasel_logo.svg        content/about-logo.svg
-#  cp                                      iceweasel_logo.svg        content/about-logo.svg # RuntimeError: File "about-logo.svg" not found in browser/branding/iceweasel/content
-  rsvg-convert -w 192 --keep-aspect-ratio iceweasel_logo.svg     -o content/about-logo.png
-  rsvg-convert -w 384 --keep-aspect-ratio iceweasel_logo.svg     -o content/about-logo@2x.png
-  cp                                      content/about-logo.png    content/about-logo-private.png
-  cp                                      content/about-logo@2x.png content/about-logo-private@2x.png
-  echo "${blank_svg}"                                             > content/$pkgname-symbolic.svg # TODO: branding package
+  cp                                      iceweasel_logo.svg         content/aboutlogins.svg
+  cp                                      iceweasel_logo.svg         content/about-logo.svg
+#  cp                                      iceweasel_logo.svg         content/about-logo.svg # RuntimeError: File "about-logo.svg" not found in browser/branding/iceweasel/content
+  rsvg-convert -w 192 --keep-aspect-ratio iceweasel_logo.svg      -o content/about-logo.png
+  rsvg-convert -w 384 --keep-aspect-ratio iceweasel_logo.svg      -o content/about-logo@2x.png
+  cp                                      content/about-logo.png     content/about-logo-private.png
+  cp                                      content/about-logo@2x.png  content/about-logo-private@2x.png
+  echo "${blank_svg}"                                              > content/$pkgname-symbolic.svg # TODO: branding package
+  cp                                      ../unofficial/document.ico document.ico
 
   popd > /dev/null
 
diff --git a/libre/iceweasel/keys/pgp/14F26682D0916CDD81E37B6D61B7B526D98F0353.asc b/libre/iceweasel/keys/pgp/14F26682D0916CDD81E37B6D61B7B526D98F0353.asc
index 6454a2f7c..dc5afa410 100644
--- a/libre/iceweasel/keys/pgp/14F26682D0916CDD81E37B6D61B7B526D98F0353.asc
+++ b/libre/iceweasel/keys/pgp/14F26682D0916CDD81E37B6D61B7B526D98F0353.asc
@@ -24,40 +24,40 @@ GJjWOI6A61bqSPepLCMVaXqV2mZEIaZWdZkOHjnRrU6CJdXG/+D4m1YBZwYM60eJ
 kNu4eMMwMFnRsHiWf7bhqKptwuk8HyIGp2o4j8iqrFRVJEbK/ctdhA3H1AlKug9f
 NrfwCfqhNCSBju97V03U26j04JMn9nrZ2UEGbpty+8ONTb38WX5/oC61BgwV8Ki4
 6Lwyb7fImUzz8jE83pjh7s3+NCKvvbH+VfT12f+V/fsphN3EwGwJPTC3fX25Ag0E
-YKLN1QEQALUkQAa6MpKjjvt2at6XoURjNmn7dnY4ooCoYVYPnia/mH3yFNkO95fc
-54mEs1TJBVbiT3e1pAZ5RDCJ/AVBodOKKejFfpM19ILrt7//Yv9GoDUt9cQHV85n
-9YubG0FNXkcpcmUUorDNorhewWK30rDgR7+9XH/ojPeCsa814gdWwzS+AzdE+frw
-qA44B2l27Xp+EHZujnYwQlL/SMfHYU+Dsx8BzlCu4KJk60DOh8m9L4ELA1yldj7P
-6VjkpPydnAq0FK2nxapFQAAt5upGhlPLXumJQFOxhXH+DDj8NeVkzNomilsD5MCv
-W/0aP+UX2W6p3XvBAQKBZINF/JrIRlQwbWAmlvtalAN2QXEM1L6LGFLDUAvTcfGP
-f7ZKgsCAVM7MbiK0mB8Xqj04cUjLwpoNqh15pmwMbGzs9w0zsCqVkkRjgkxhabCw
-alooIxvi/vYiMfu5K9oB/LWHJNUT8kJtOJPbnQ/MMFwr8pU1MzVXfO+rDd6Ncckm
-juZ8/CbTP/8Tz3LRRTGZgtNWwZ/o0bmqQ6mPqkxS/nioXqzlGYLN5x7e3BAc95vJ
-3hoNPyYcgcEurEBe4dBEwWqVQ5SgkbrwICRyK43oy+b/pFUax/S+nsuQgHURvUm3
-37DcGaKOaPEq3RnF+oaRYqoNY2Vr2b+ce/zz0lu3z7jTR7KMVUZ/ABEBAAGJBHIE
-GAEKACYWIQQU8maC0JFs3YHje21ht7Um2Y8DUwUCYKLN1QIbAgUJA8JnAAJACRBh
-t7Um2Y8DU8F0IAQZAQoAHRYhBENg/iEJxJdjGG+OIevkHpD28S9tBQJgos3VAAoJ
-EOvkHpD28S9tjesP/jm5hVqQq9HZldbZvtbbgi9ObCdN9ShZdxJB9/PRZqzDKFZO
-PXux+VK5++3s0FzvTHvEdJ2YFVGryXSnCc4H9SGbS6uVauauetyPIIJa/KyWmnnx
-mLr/Y4rcfwmtrPrryTFB4DHgT5hRTiqCBfEIDiXZEobdpSJHem3fPWsiy6CF5Rov
-HeiuLRFnjIoLXbPRWHMl+6PMV5rfV6giGjG5CbYlM48+t3TdDvNVAo9E7yteylwL
-3JYc664mbqNqzng0wXEJiistlCmWiY1Kons7joNbedd2SM4ctaF84OQiW+Y4LJmZ
-o7SY69etX7+XfGKHJI+989v8+O8K8uk4REn2EpCMSSIiD+UsGcjTHnh0mVJ2jE6s
-3eZAy+apza4SRwgQcsXCAXBqab91Y2dUDVNZNE8fjM6X2bWxP/4ncPkOyM/U/984
-ze/SYWItbc82mkEeiaBIjTKRx5HZDhkcH3YqTO6CpexypfsyQs2i0xOJmyJwsUoJ
-/tUYSPqxs011caiCqJ2K1q2uBFQQIILjK8TTI7hLW7BeeENu8dvh/zHsPnreiv7L
-qsoet0s33deC1hI+DWkfPbRM++pyciRbhbQ3hkpruvPz4uUvC7PTMSiSYiCZnN5U
-Kg1ExxIi3O0bWQLIAFpS3OlJxbGgqlyicbmjLO6hQ+6akhnx8WG6AcWse0qq7bcP
-/3gu64IYhc33JxGUJ+vhj1txSXOT9XYki7aPfbIsd7mlio70p2UnLzznvKICbdSU
-KUAAAaB33ex885RsybVP8gy/d9Vg+pxE6em/3ZO7d2lKZPFhTBtfS/i/UGxKY8Q4
-tsKMzuwhoOhYQu5rvirErKKy6nd0GCqASxtD29it2c9zze8te5H9QIsWtv/6axTX
-6RBsD/X5c9k1L0nbXfSb3Jw8/v98get7ZrgrFD2Wkd5YU5DYl2Ru1kwCwNQKiFCh
-acSPnDkMWjtvh+l14jjd8fANj83dZmcrlDD5NnOiP3NWX8yV8Rf1iVX7s7WVzQhq
-HGBeJAd19O7jroiqyAzFw09zqd8CdESJ6Y8sj5cMKL98yFUHBt5n1j3JVzXCEUgH
-WnS6usoUwVFW4THdo9qoGtb7WlZR/5tMxYYm/PES39fxYlV++g9avmpxvoE/krDD
-3e4UhkENvup4AQL8eE9SB7RYD6nzWgOPZvG92gKKxqOgW85sIeF6/uwzNn0rJAbJ
-BnSD2YAOFcruPzwuWgk8ndDapQYI/4O10UDBrxUZHZxCHFWW78Xc5+I9enUvuN3V
-MxTCyk4UW5FGrp2mKGTyGLoqm8AqBV+7yXYATGk8WH5ApXOSyUla/l/vUWDcJTp+
-JIkMyrLVbZf6n6Q6MOkLBpgPSe7/FbfSRINOdkRHGWZg
-=/ReQ
+ZFVAcwEQANXA95+bntLAnGZql9hW7SBUbJN/a5RpL7sWAAbFgU869EW0Vu4eOlc1
+mznFOWZmya6f24YJEmEUd3a5s0+t8lGetnZ8MOnuSyYxkrdfc83G3q/QRxC46iqn
+wHyzbLme2UOae/HOroiYXvFqW1qIG7KcSdtHbq2ixpiuCpdt32t7RdBp4NUS4aBX
+ElSv1rQ2cgvnpTyqXIdUq7urMP6/JLX7oTSERsXW4/5RRzVTswl29zEwKqSMpzRj
+KHBRZ6li2S7SLaYR8T1Kla+iyr3N4t2jJQuiLyzYNDbvDtPPB4NwIfbUZlyjrIS4
+2Iz3l6jPXnaqFlqqc8Q0zZeiZRTMD/jmnDCrMl+1qvmVwv6N8oAv6HJWFCrYrqBo
+OO30gjdhkt1dhl9sxZU+khLxEEG9oOciEi1/UP4PQMiXarX2i3uBb+rzOD9cYTlA
+545naLpZtxRpAu9NWRe3hYTEkVDPUIZBh+mM9k70uIbeloYO2lbeBKyKCX4/Y8yT
+qepPb52uS5oJI/JdfTU4lEO4JPfB98FuJkayDcWdskA+O1fyyfrVGpiXOWnPiNFT
++3NecZihCdq3xghoYklkMGWcO2Nv6qAA0gZSNvEZQU7kT9ougHcMiVPu+Qs8RszK
+a/8AS4WU/nzUVeBx3eXYEd2MWo6ZM2esFy9mmiYc5xRJiwS6JDsDABEBAAGJBHIE
+GAEKACYWIQQU8maC0JFs3YHje21ht7Um2Y8DUwUCZFVAcwIbAgUJA8JnAAJACRBh
+t7Um2Y8DU8F0IAQZAQoAHRYhBK3XB5R5cA3K391TN+NtOxPz2TJ0BQJkVUBzAAoJ
+EONtOxPz2TJ0YHYP/iwIWvFYdUiFaV81B1XcfNZD8sQUml7TrWwcOrvRIj1vsQlI
+hf6cp+x9ZbvoQKHXjRQA7F5pjjSnAY1EVX8DvNbOtICymAV8aXCy0F63zTi62DJ6
+JK+RX7iN82dAKEpxKEvbn53/+7KY22vEZXVdatpK3cNSrW4i6tw/L+BN6kX8eUqg
+gPniUmr2gId2gYupb0ZVEmZs/EVsKuoD/WeAYk08haeY0L9WSiW+TifuOANKUvkb
+xg0av2wAFEFCyyCVToYkzO+LG/wT5nkWFEvvnntdCBVuG7KyiaJwqEkE10HsTqR+
+gABV3mQ2pCX8o08Z5d/gLQOFRKdVCSJtGMHtIepU9IrEiT1ad0RWUT46tIPv1Z4g
+bL2ISxP+9KYfSJlOB13TbpmVal6msJiA0cL+zW2I6UPEJ83D97yeV0OP2zVP8Vnd
+XjNoHaW1yPQeOhEe30HCCUTa2sGxG387h8uZyDQM6857IPnwAu+sNjpq5+eO0ImN
+nsu48u5O/bZQlxl1gLfYpJCfeQQi7DruTk8T4uP1FEtnp9cg28eXo+x4e/aBGcc7
+m1tfr+TtfrV4DDlnemYF8KrqudL7Pl+JouwShNm9TIumatmPisO3QBG2GM4bEgPk
+kT7ub6yYC0zUJhscW60gPpQlL0PHT8sF89NLyokMCPbkarStC19QS7hyiIYODoMQ
+AJ5hUmYLu8CLBNpAWMGmwkiBSWcx7tJYLUcmK2PF4ez4PlfbJSIjBhuEiMquXlH5
+lPG143OL0JBOih8bG28zeoBVS19Sg48USofv5xv0Q7X8P4nO4ol2X4JBKsyFYCK7
+ZQ2/wyumQzHgAZyXGWUyTAAuJVqSRoJp2cXwCBprXFDgNAihk+N7LsmBE+y+x13d
+EzPnCUZ2xG+5vDnsU/V6qsHs36qItTBh9oPJUSkBOGdnhBbworiZwsOeO8LaSVhE
+KxsNXqi9wEvGNOdWKm5W1y24H+TmuPcqOt9HoavTsaC3e/hnVsGAZa/9BMz1Fns4
+XSCir4dUTvhUBgJc2Cej6uwT8L7t3Qt2GHTdwMf/HY+dN+mPph4A7J5pVJPHZc4i
+dDt4dX5Hv1vNQAceAEgZLVwH9SMHkW28alvDoDIRusR03ohI42r+0ppQ9F1TsY4S
+PqgaDT6L1pQoajjcWm5QZLodCXepHTYmkhDPXHetJCtxk/3QTMr9MlYYS3Iuh0Gf
+jH+HG59CrWss7kCznHUQjdxRfyTUB97+iwNTHUX5iZYAuFHYnqQW9bgoLVSD4s0b
+l1g48o83j2UTfwKmlGxKDQR4SM9JyoUBg27LeLoCMyViF/ulKJMDwt47yakELbXH
+IwMupFwZsX8ckTAeQRHi2NPqlT8rzsaVxBp5Uh2JnSEu
+=n66D
 -----END PGP PUBLIC KEY BLOCK-----
diff --git a/libre/iceweasel/zstandard-0.21.0.diff b/libre/iceweasel/zstandard-0.21.0.diff
new file mode 100644
index 000000000..f99ef3eb3
--- /dev/null
+++ b/libre/iceweasel/zstandard-0.21.0.diff
@@ -0,0 +1,10 @@
+diff --git a/python/sites/mach.txt b/python/sites/mach.txt
+index d105723399..b10a7e42d7 100644
+--- a/python/sites/mach.txt
++++ b/python/sites/mach.txt
+@@ -143,4 +143,4 @@ pypi-optional:glean-sdk==52.7.0:telemetry will not be collected
+ # We aren't (yet) able to pin packages in automation, so we have to
+ # support down to the oldest locally-installed version (5.4.2).
+ pypi-optional:psutil>=5.4.2,<=5.9.4:telemetry will be missing some data
+-pypi-optional:zstandard>=0.11.1,<=0.19.0:zstd archives will not be possible to extract
++pypi-optional:zstandard>=0.11.1,<=0.21.0:zstd archives will not be possible to extract