resolve merge conflicts

.github/CODEOWNERS

@@ -71,6 +71,7 @@ bitwarden_license/bit-web/src/app/billing @bitwarden/team-billing-dev
 ## Platform team files ##
 apps/browser/src/platform @bitwarden/team-platform-dev
 apps/cli/src/platform @bitwarden/team-platform-dev
+apps/desktop/macos @bitwarden/team-platform-dev
 apps/desktop/src/platform @bitwarden/team-platform-dev
 apps/web/src/app/platform @bitwarden/team-platform-dev
 libs/angular/src/platform @bitwarden/team-platform-dev
@@ -91,6 +92,7 @@ apps/web/src/translation-constants.ts @bitwarden/team-platform-dev
 apps/browser/src/autofill @bitwarden/team-autofill-dev
 apps/desktop/src/autofill @bitwarden/team-autofill-dev
 libs/common/src/autofill @bitwarden/team-autofill-dev
+apps/desktop/macos/autofill-extension @bitwarden/team-autofill-dev
 # DuckDuckGo integration
 apps/desktop/native-messaging-test-runner @bitwarden/team-autofill-dev
 apps/desktop/src/services/native-message-handler.service.ts @bitwarden/team-autofill-dev
@@ -122,6 +124,9 @@ apps/cli/src/locales/en/messages.json
 apps/desktop/src/locales/en/messages.json
 apps/web/src/locales/en/messages.json
 
+## Ssh agent temporary co-codeowner
+apps/desktop/desktop_native/core/src/ssh_agent @bitwarden/team-platform-dev @bitwarden/wg-ssh-keys
+
 ## BRE team owns these workflows ##
 .github/workflows/brew-bump-desktop.yml @bitwarden/dept-bre
 .github/workflows/deploy-web.yml @bitwarden/dept-bre

.github/renovate.json

@@ -35,18 +35,18 @@
       "matchPackageNames": ["@types/jest", "jest", "ts-jest", "jest-preset-angular"],
       "matchUpdateTypes": "major"
     },
+    {
+      "groupName": "macOS/iOS bindings",
+      "matchPackageNames": ["core-foundation", "security-framework", "security-framework-sys"]
+    },
     {
       "matchPackageNames": [
-        "@ngtools/webpack",
         "base64-loader",
         "buffer",
         "bufferutil",
-        "copy-webpack-plugin",
         "core-js",
         "css-loader",
         "html-loader",
-        "html-webpack-injector",
-        "html-webpack-plugin",
         "mini-css-extract-plugin",
         "ngx-infinite-scroll",
         "postcss",
@@ -56,20 +56,15 @@
         "sass-loader",
         "style-loader",
         "ts-loader",
-        "tsconfig-paths-webpack-plugin",
         "url",
-        "util",
-        "webpack",
-        "webpack-cli",
-        "webpack-dev-server",
-        "webpack-node-externals"
+        "util"
       ],
       "description": "Admin Console owned dependencies",
       "commitMessagePrefix": "[deps] AC:",
       "reviewers": ["team:team-admin-console-dev"]
     },
     {
-      "matchPackageNames": ["@types/node-ipc", "node-ipc", "qrious", "regedit"],
+      "matchPackageNames": ["qrious"],
       "description": "Auth owned dependencies",
       "commitMessagePrefix": "[deps] Auth:",
       "reviewers": ["team:team-auth-dev"]
@@ -106,19 +101,43 @@
     },
     {
       "matchPackageNames": [
-        "@types/argon2-browser",
+        "@babel/core",
+        "@babel/preset-env",
+        "@electron/notarize",
+        "@electron/rebuild",
+        "@ngtools/webpack",
         "@types/chrome",
         "@types/firefox-webext-browser",
+        "@types/glob",
         "@types/jquery",
+        "@types/lowdb",
         "@types/node",
         "@types/node-forge",
-        "argon2",
-        "argon2-browser",
-        "big-integer",
+        "@types/node-ipc",
+        "@yao-pkg",
+        "babel-loader",
+        "browserslist",
+        "copy-webpack-plugin",
+        "electron",
+        "electron-builder",
+        "electron-log",
+        "electron-reload",
+        "electron-store",
+        "electron-updater",
+        "html-webpack-injector",
+        "html-webpack-plugin",
+        "lowdb",
         "node-forge",
+        "node-ipc",
+        "pkg",
         "rxjs",
+        "tsconfig-paths-webpack-plugin",
         "type-fest",
-        "typescript"
+        "typescript",
+        "webpack",
+        "webpack-cli",
+        "webpack-dev-server",
+        "webpack-node-externals"
       ],
       "description": "Platform owned dependencies",
       "commitMessagePrefix": "[deps] Platform:",
@@ -193,19 +212,11 @@
     },
     {
       "matchPackageNames": [
-        "@electron/notarize",
-        "@electron/rebuild",
         "@microsoft/signalr-protocol-msgpack",
         "@microsoft/signalr",
         "@types/jsdom",
         "@types/papaparse",
         "@types/zxcvbn",
-        "electron-builder",
-        "electron-log",
-        "electron-reload",
-        "electron-store",
-        "electron-updater",
-        "electron",
         "jsdom",
         "jszip",
         "oidc-client-ts",
@@ -227,7 +238,6 @@
         "@types/koa__router",
         "@types/koa-bodyparser",
         "@types/koa-json",
-        "@types/lowdb",
         "@types/lunr",
         "@types/node-fetch",
         "@types/proper-lockfile",
@@ -240,19 +250,23 @@
         "koa",
         "koa-bodyparser",
         "koa-json",
-        "lowdb",
         "lunr",
         "multer",
         "node-fetch",
         "open",
-        "pkg",
         "proper-lockfile",
         "qrcode-parser"
       ],
       "description": "Vault owned dependencies",
       "commitMessagePrefix": "[deps] Vault:",
       "reviewers": ["team:team-vault-dev"]
+    },
+    {
+      "matchPackageNames": ["@types/argon2-browser", "argon2", "argon2-browser", "big-integer"],
+      "description": "Key Management owned dependencies",
+      "commitMessagePrefix": "[deps] KM:",
+      "reviewers": ["team:team-key-management-dev"]
     }
   ],
-  "ignoreDeps": ["@types/koa-bodyparser", "bootstrap", "node-ipc", "node", "npm", "regedit"]
+  "ignoreDeps": ["@types/koa-bodyparser", "bootstrap", "node-ipc", "node", "npm"]
 }

.github/workflows/auto-branch-updater.yml

@@ -28,7 +28,7 @@ jobs:
         run: echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
 
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: 'eu-web-${{ steps.setup.outputs.branch }}'
           fetch-depth: 0

.github/workflows/build-browser.yml

@@ -1,7 +1,8 @@
 name: Build Browser
 
 on:
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
       - 'cf-pages'
@@ -33,16 +34,24 @@ defaults:
     shell: bash
 
 jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
   setup:
     name: Setup
     runs-on: ubuntu-22.04
+    needs:
+      - check-run
     outputs:
       repo_url: ${{ steps.gen_vars.outputs.repo_url }}
       adj_build_number: ${{ steps.gen_vars.outputs.adj_build_number }}
       node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
 
       - name: Get Package Version
         id: gen_vars
@@ -71,8 +80,10 @@ jobs:
       run:
         working-directory: apps/browser
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
 
       - name: Testing locales - extName length
         run: |
@@ -109,11 +120,13 @@ jobs:
       _BUILD_NUMBER: ${{ needs.setup.outputs.adj_build_number }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
 
       - name: Set up Node
-        uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -163,10 +176,6 @@ jobs:
         run: npm run dist:mv3
         working-directory: browser-source/apps/browser
 
-      - name: Build Chrome Manifest v3 Beta
-        run: npm run dist:chrome:beta
-        working-directory: browser-source/apps/browser
-
       - name: Upload Opera artifact
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
@@ -188,13 +197,6 @@ jobs:
           path: browser-source/apps/browser/dist/dist-chrome-mv3.zip
           if-no-files-found: error
 
-      - name: Upload Chrome MV3 Beta artifact (DO NOT USE FOR PROD)
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
-        with:
-          name: DO-NOT-USE-FOR-PROD-dist-chrome-MV3-beta-${{ env._BUILD_NUMBER }}.zip
-          path: browser-source/apps/browser/dist/dist-chrome-mv3-beta.zip
-          if-no-files-found: error
-
       - name: Upload Firefox artifact
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
@@ -240,11 +242,13 @@ jobs:
       _BUILD_NUMBER: ${{ needs.setup.outputs.adj_build_number }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
 
       - name: Set up Node
-        uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -347,14 +351,16 @@ jobs:
 
   crowdin-push:
     name: Crowdin Push
-    if: github.ref == 'refs/heads/main'
+    if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-22.04
     needs:
       - build
       - build-safari
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
 
       - name: Login to Azure
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
@@ -392,7 +398,10 @@ jobs:
       - crowdin-push
     steps:
       - name: Check if any job failed
-        if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/rc' || github.ref == 'refs/heads/hotfix-rc') && contains(needs.*.result, 'failure')
+        if: |
+          github.event_name != 'pull_request_target'
+          && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/rc' || github.ref == 'refs/heads/hotfix-rc-browser')
+          && contains(needs.*.result, 'failure')
         run: exit 1
 
       - name: Login to Azure - Prod Subscription