diff --git a/.github/openclaw/artifacts.py b/.github/openclaw/artifacts.py
index 73a54c982c4e4..2785402474304 100644
--- a/.github/openclaw/artifacts.py
+++ b/.github/openclaw/artifacts.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Owned packaging and provenance around the unchanged upstream lane runner."""
+"""Owned packaging and provenance around the pinned upstream lane runner."""
 import argparse
 import hashlib
 import json
@@ -15,6 +15,10 @@
 ROOT = Path(__file__).resolve().parents[2]
 CONFIG = json.loads((ROOT / '.github/openclaw/variants.json').read_text())
 RECIPE = ['.github/scripts/lanes.mjs', 'Dockerfile', 'Dockerfile.musl', 'Dockerfile.macos', 'Dockerfile.windows', 'icu', 'macos-cross']
+# Keep the engine comparison BASE; admit only these reviewed runtime and CA updates.
+# Tree identities include file modes and every descendant of recipe directories.
+RECIPE_REVISION = {'reviewed_source':'670af3032b19a37504d389437c871ebbdf2f35a4',
+    'tree_sha256':'03e3c253c84d9738a17530c6490325c778f8d995212b598af66a283cc5d9389f'}
 
 def run(*args, **kwargs):
     return subprocess.run(args, check=True, text=True, **kwargs)
@@ -34,7 +38,9 @@ def source():
     if not re.fullmatch('[0-9a-f]{40}', sha):
         raise ValueError('full source SHA required')
     run('git', 'merge-base', '--is-ancestor', BASE, sha)
-    run('git', 'diff', '--exit-code', BASE, sha, '--', *RECIPE)
+    recipe = subprocess.check_output(['git', 'ls-tree', '--full-tree', '-z', sha, '--', *RECIPE])
+    if hashlib.sha256(recipe).hexdigest() != RECIPE_REVISION['tree_sha256']:
+        raise ValueError('source recipe differs from the reviewed revision')
     run('git', 'diff', '--exit-code', 'HEAD')
     return sha
 
@@ -65,7 +71,7 @@ def build(label, destination):
     provenance = destination / 'provenance'
     provenance.mkdir()
     command = json.loads(capture('node', '.github/scripts/lanes.mjs', 'build', label, '--output', str(artifact), '--dry-run'))
-    # Build the unchanged base locally. No image registry write or inherited workflow is used.
+    # Build the pinned recipe base locally. No image registry write or inherited workflow is used.
     base_tag = 'openclaw-webkit-toolchain:' + hashlib.sha256(lane['image'].encode()).hexdigest()[:24]
     base_command = command[:command.index('--target=artifact')] + ['--target=base', '--load', '--tag', base_tag, '--metadata-file', str(provenance/'toolchain-build.json'), '.']
     run('docker', 'buildx', 'use', 'default')
@@ -92,7 +98,7 @@ def build(label, destination):
     for commit in capture('git','rev-list','--reverse',BASE+'..'+sha).splitlines():
         patch = subprocess.check_output(['git','show','--format=','--binary',commit])
         patches.append({'commit':commit,'subject':capture('git','show','-s','--format=%s',commit),'patch_sha256':hashlib.sha256(patch).hexdigest()})
-    manifest = {'schema_version':1,'source':sha,'base':BASE,'lane':lane,'patches':patches,
+    manifest = {'schema_version':1,'source':sha,'base':BASE,'recipe_revision':RECIPE_REVISION,'lane':lane,'patches':patches,
         'recipe_sha256':{p:digest(ROOT/p) for p in paths},'toolchain_image_id':image['Id'],
         'commands':{'base':base_command,'artifact':build_command},
         'tool_versions':tool_versions,'docker_version':capture('docker','version'),'buildx_version':capture('docker','buildx','version'),
diff --git a/.github/openclaw/qualification/patches/013-node-reference-fixtures.patch b/.github/openclaw/qualification/patches/013-node-reference-fixtures.patch
new file mode 100644
index 0000000000000..9f7e03e92b440
--- /dev/null
+++ b/.github/openclaw/qualification/patches/013-node-reference-fixtures.patch
@@ -0,0 +1,17 @@
+diff --git a/test/js/node/process/process.test.js b/test/js/node/process/process.test.js
+--- a/test/js/node/process/process.test.js
++++ b/test/js/node/process/process.test.js
+@@ -1056,3 +1056,3 @@
+     let [out, exited] = await Promise.all([new Response(subprocess.stdout).text(), subprocess.exited]);
+-    expect(out.trim()).toEqual("v26.3.0");
++    expect(out.trim()).toEqual("v26.12.1");
+     expect(exited).toBe(0);
+diff --git a/test/js/node/tls/node-tls-client-wrap-fixture.mjs b/test/js/node/tls/node-tls-client-wrap-fixture.mjs
+--- a/test/js/node/tls/node-tls-client-wrap-fixture.mjs
++++ b/test/js/node/tls/node-tls-client-wrap-fixture.mjs
+@@ -305,3 +305,4 @@
+   const host = "127.0.0.1";
+-  const options = { session, rejectUnauthorized: false };
++  // Node binds reusable sessions to the peer identity, including over an existing socket.
++  const options = { session, host, rejectUnauthorized: false };
+   // The listener is attached in the turn that makes the socket: a wrap starts its handshake at once.
diff --git a/.github/openclaw/qualify.sh b/.github/openclaw/qualify.sh
index 46307594e746b..56d89df79c8f2 100644
--- a/.github/openclaw/qualify.sh
+++ b/.github/openclaw/qualify.sh
@@ -20,6 +20,9 @@ git apply "$inputs/patches/000-checksums.patch"
 # Apply openclaw/bun#151 equally to both frozen-source arms.
 git apply "$inputs/patches/012-vm-finalization-fixture.patch"
 sha256sum "$inputs/patches/012-vm-finalization-fixture.patch" > "$QUALIFICATION_DIR/vm-finalization-fixture.sha256"
+# Match the qualified host Node and preserve its authenticated session identity in both arms.
+git apply "$inputs/patches/013-node-reference-fixtures.patch"
+sha256sum "$inputs/patches/013-node-reference-fixtures.patch" > "$QUALIFICATION_DIR/node-reference-fixtures.sha256"
 bootstrap=$(command -v bun)
 "$bootstrap" install --frozen-lockfile
 (cd test && "$bootstrap" install --frozen-lockfile)
@@ -58,9 +61,14 @@ for arm in baseline candidate; do
   cp "$inputs/selected.json" build/openclaw-ci/selected.json
   cp "$inputs/selected.json" "$results/selected.json"
   rm -f build/openclaw-ci/results.json
-  env -u BUN_WEBKIT_ARTIFACT_MANIFEST -u BUN_BUILD_CACHE_DIR -u BUN_BUILD_PREFETCH_DIR \
+  # Retain both arms when a reference fails; the strict all-pass gate below still rejects failures.
+  if env -u BUN_WEBKIT_ARTIFACT_MANIFEST -u BUN_BUILD_CACHE_DIR -u BUN_BUILD_PREFETCH_DIR \
     HOME="$results/home" TMPDIR="$results/tmp" PATH="$results/bin:$PATH" OPENCLAW_CI_PLATFORM=linux \
-    "$candidate" scripts/openclaw-ci/tests.ts test > "$results/tests.log" 2>&1
+    "$candidate" scripts/openclaw-ci/tests.ts test > "$results/tests.log" 2>&1; then
+    printf '0\n' > "$results/exit-code.log"
+  else
+    printf '%s\n' "$?" > "$results/exit-code.log"
+  fi
   cp build/openclaw-ci/results.json "$results/results.json"
 done
 python3 "$inputs/compare-fork-ci.py" "$QUALIFICATION_DIR/baseline" "$QUALIFICATION_DIR/candidate" --output "$QUALIFICATION_DIR/faithfulness.json"
@@ -96,6 +104,7 @@ from pathlib import Path
 root=Path(sys.argv[1])
 faith=json.loads((root/'faithfulness.json').read_text())
 assert faith['identical_file_outcomes'] and faith['all_passed']
+assert all((root/arm/'exit-code.log').read_text().strip() == '0' for arm in ['baseline','candidate']), 'fork test runner failed'
 assert faith['selected_files']==44 and faith['result_files']==46
 for name in ['als-plugin','als-native']:
  rows=json.loads((root/(name+'.json')).read_text())['results']
diff --git a/.github/openclaw/test_release.py b/.github/openclaw/test_release.py
index a91e747ca5a06..9240cbba05fc4 100644
--- a/.github/openclaw/test_release.py
+++ b/.github/openclaw/test_release.py
@@ -1,5 +1,7 @@
+import hashlib
 import importlib.util
 import json
+import os
 from pathlib import Path
 import subprocess
 import tempfile
@@ -9,6 +11,8 @@
 
 spec=importlib.util.spec_from_file_location('release',Path(__file__).with_name('release.py'))
 release=importlib.util.module_from_spec(spec);spec.loader.exec_module(release)
+spec=importlib.util.spec_from_file_location('artifacts',Path(__file__).with_name('artifacts.py'))
+artifacts=importlib.util.module_from_spec(spec);spec.loader.exec_module(artifacts)
 SOURCE='a'*40
 
 class ReleaseIntegrity(unittest.TestCase):
@@ -100,4 +104,50 @@ def test_authorization_rejects_other_branch(self):
             with self.assertRaisesRegex(ValueError,'reviewed source'):release.authorize(SOURCE,42)
             execute.assert_not_called()
 
+class ArtifactRecipe(unittest.TestCase):
+    def setUp(self):
+        self.temp=tempfile.TemporaryDirectory();self.addCleanup(self.temp.cleanup)
+        self.root=Path(self.temp.name)
+        self.addCleanup(os.chdir,Path.cwd());os.chdir(self.root)
+        self.git('init','-q')
+        self.git('config','user.name','Recipe fixture');self.git('config','user.email','fixture@example.invalid')
+        self.git('config','commit.gpgsign','false')
+        for name in artifacts.RECIPE:
+            p=self.root/name
+            if name in ('icu','macos-cross'):p=p/'input.txt'
+            p.parent.mkdir(parents=True,exist_ok=True);p.write_text('reviewed input\n')
+        (self.root/'Dockerfile').write_text('ARG NODE_VERSION=24.16.0\n')
+        (self.root/'source.txt').write_text('engine source\n')
+        self.commit('upstream base');self.base=self.git('rev-parse','HEAD')
+        (self.root/'Dockerfile').write_text('ARG NODE_VERSION=24.22.1\n')
+        self.commit('reviewed Node security update')
+        recipe=subprocess.check_output(['git','ls-tree','--full-tree','-z','HEAD','--',*artifacts.RECIPE])
+        revision={'reviewed_source':self.git('rev-parse','HEAD'),'tree_sha256':hashlib.sha256(recipe).hexdigest()}
+        for name,value in [('BASE',self.base),('RECIPE_REVISION',revision)]:
+            p=patch.object(artifacts,name,value,create=True);p.start();self.addCleanup(p.stop)
+    def git(self,*args):
+        return subprocess.check_output(['git',*args],text=True).strip()
+    def commit(self,message):
+        self.git('add','.');self.git('commit','-qm',message)
+    def test_reviewed_recipe_survives_squash_and_later_engine_commits(self):
+        self.git('reset','--hard',self.base)
+        (self.root/'Dockerfile').write_text('ARG NODE_VERSION=24.22.1\n')
+        self.commit('squashed reviewed update')
+        self.assertEqual(artifacts.source(),self.git('rev-parse','HEAD'))
+        (self.root/'source.txt').write_text('security-patched engine source\n')
+        self.commit('engine change after reviewed recipe')
+        self.assertEqual(artifacts.source(),self.git('rev-parse','HEAD'))
+    def test_unreviewed_recipe_and_dirty_source_are_rejected(self):
+        (self.root/'source.txt').write_text('uncommitted engine change\n')
+        with self.assertRaises(subprocess.CalledProcessError):artifacts.source()
+        self.git('checkout','--','source.txt')
+        for name,mode in [('Dockerfile',False),('icu/input.txt',False),('Dockerfile',True)]:
+            with self.subTest(path=name,mode=mode):
+                p=self.root/name
+                if mode:p.chmod(0o755)
+                else:p.write_text('unreviewed recipe input\n')
+                self.commit('unreviewed recipe change')
+                with self.assertRaisesRegex(ValueError,'recipe differs'):artifacts.source()
+                self.git('reset','--hard','HEAD^')
+
 if __name__=='__main__':unittest.main()
diff --git a/.github/workflows/openclaw-artifacts.yml b/.github/workflows/openclaw-artifacts.yml
index 4d5ea084851cf..3cd349ec45818 100644
--- a/.github/workflows/openclaw-artifacts.yml
+++ b/.github/workflows/openclaw-artifacts.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
-          fetch-depth: 16
+          fetch-depth: 0
           persist-credentials: false
           sparse-checkout-cone-mode: false
           sparse-checkout: |
@@ -38,7 +38,7 @@ jobs:
             !/WebDriverTests/
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '26.3.0'
+          node-version: '26.12.1'
       - name: Test publication integrity gates
         run: python3 .github/openclaw/test_release.py
       - name: Measure runner capacity and Docker support
@@ -59,7 +59,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
-          fetch-depth: 16
+          fetch-depth: 0
           persist-credentials: false
           sparse-checkout-cone-mode: false
           sparse-checkout: |
@@ -72,7 +72,7 @@ jobs:
             !/WebDriverTests/
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '26.3.0'
+          node-version: '26.12.1'
       - name: Build unchanged upstream lane and record provenance
         env:
           LANE: ${{ matrix.lane }}
@@ -96,7 +96,7 @@ jobs:
           sparse-checkout: .github
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '26.3.0'
+          node-version: '26.12.1'
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: bun-webkit-linux-amd64
diff --git a/.github/workflows/openclaw-checks.yml b/.github/workflows/openclaw-checks.yml
index 8206b2dedc22a..946ce5e4f2871 100644
--- a/.github/workflows/openclaw-checks.yml
+++ b/.github/workflows/openclaw-checks.yml
@@ -31,7 +31,7 @@ jobs:
             /JSTests/stress/
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '26.3.0'
+          node-version: '26.12.1'
       - name: Verify pipeline integrity and runner support
         run: |
           python3 .github/openclaw/test_release.py
@@ -152,6 +152,6 @@ jobs:
             !/WebDriverTests/
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '26.3.0'
+          node-version: '26.12.1'
       - name: Build the macOS fork artifact on Linux without publishing
         run: python3 .github/openclaw/artifacts.py build --lane bun-webkit-macos-arm64 --output "$RUNNER_TEMP/macos-fork-artifact"
diff --git a/Dockerfile b/Dockerfile
index 87d4f9950bad5..33326d87be35a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,7 +63,7 @@ RUN curl -fsSL "https://github.com/facebook/zstd/releases/download/v${ZSTD_VERSI
     && zstd --version
 
 # Install Node (for icu/compress-data.ts; needs >=23.6 for default type stripping)
-ARG NODE_VERSION=24.16.0
+ARG NODE_VERSION=24.22.1
 RUN curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tar.xz" \
     | tar -xJ -C /usr/local --strip-components=1 \
     && node --version
diff --git a/Dockerfile.musl b/Dockerfile.musl
index ebc80602503e8..5833026431038 100644
--- a/Dockerfile.musl
+++ b/Dockerfile.musl
@@ -12,6 +12,7 @@ ARG LINUX_ARCH="x86_64"
 # `--build-context base=docker-image://...`, which replaces this stage (.github/workflows/ci.yml, the `image` job).
 # Without that, it is built here like any other stage. Lane settings belong in `lane` below.
 FROM alpine:3.23 as base
+RUN apk add --no-cache --upgrade ca-certificates-bundle=20261020-r0
 
 # LLVM 23 is in Alpine edge only. `@edge` is a tagged repository: apk takes a package from it only when the package is
 # asked for with that tag, or when a tagged package needs something 3.23 does not have. So musl, libstdc++ and gcc stay
diff --git a/Dockerfile.windows b/Dockerfile.windows
index 2d2df0b75962a..b091430909c2c 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -202,7 +202,7 @@ RUN for pair in "x86_64 x64" "aarch64 arm64"; do \
 # (>= 23.6 for type stripping), and patch for the udata.cpp hook. zstd's lib/ sources stay, at /zstd/lib: jsc.exe builds
 # the decoder from them to read the repacked data (shell/CMakeLists.txt, BUN_ICU_ZSTD_SOURCE_DIR).
 ARG ZSTD_VERSION=1.5.7
-ARG NODE_VERSION=24.16.0
+ARG NODE_VERSION=24.22.1
 RUN apt-get update && apt-get install -y --no-install-recommends patch && rm -rf /var/lib/apt/lists/* && \
     curl -fsSL "https://github.com/facebook/zstd/releases/download/v${ZSTD_VERSION}/zstd-${ZSTD_VERSION}.tar.gz" | tar xz -C /tmp && \
     make -C /tmp/zstd-${ZSTD_VERSION}/programs zstd -j$(nproc) CC=clang-${LLVM_VERSION} && \
diff --git a/LayoutTests/imported/w3c/web-platform-tests/tools/third_party/certifi/certifi/cacert.pem b/LayoutTests/imported/w3c/web-platform-tests/tools/third_party/certifi/certifi/cacert.pem
index 2713f541c4498..39b514651927f 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/tools/third_party/certifi/certifi/cacert.pem
+++ b/LayoutTests/imported/w3c/web-platform-tests/tools/third_party/certifi/certifi/cacert.pem
@@ -363,31 +363,6 @@ LBfQdCVp9/5rPJS+TUtBjE7ic9DjkCJzQ83z7+pzzkWKsKZJ/0x9nXGIxHYdkFsd
 # MD5 Fingerprint: 49:79:04:b0:eb:87:19:ac:47:b0:bc:11:51:9b:74:d0
 # SHA1 Fingerprint: d1:eb:23:a4:6d:17:d6:8f:d9:25:64:c2:f1:f1:60:17:64:d8:e3:49
 # SHA256 Fingerprint: d7:a7:a0:fb:5d:7e:27:31:d7:71:e9:48:4e:bc:de:f7:1d:5f:0c:3e:0a:29:48:78:2b:c8:3e:e0:ea:69:9e:f4
------BEGIN CERTIFICATE-----
-MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
-MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
-GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
-YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
-MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
-BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
-GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
-BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
-3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
-YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
-rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
-ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
-oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
-MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
-QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
-b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
-AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
-GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
-Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
-G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
-l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
-smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
------END CERTIFICATE-----
 
 # Issuer: CN=QuoVadis Root Certification Authority O=QuoVadis Limited OU=Root Certification Authority
 # Subject: CN=QuoVadis Root Certification Authority O=QuoVadis Limited OU=Root Certification Authority
diff --git a/Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/ssl_roots.h b/Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/ssl_roots.h
index 5fa82b07f3215..d5a98a1fba0f3 100644
--- a/Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/ssl_roots.h
+++ b/Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/ssl_roots.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2023 The WebRTC Project Authors. All rights reserved.
+ *  Copyright 2026 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
@@ -15,14 +15,14 @@
 
 // This file is the root certificates in C form.
 
-// It was generated at 2023-05-09T15:05:10+00:00 by the following script:
-// `tools_webrtc/sslroots/generate_sslroots.py https://pki.goog/roots.pem`
+// It was generated at 2026-10-21T20:28:50+00:00 by the following script:
+// `tools_webrtc/sslroots/generate_sslroots.py roots.pem`
 
 // clang-format off
 // Don't bother formatting generated code,
 // also it would breaks subject/issuer lines.
 
-// Source bundle `https://pki.goog/roots.pem` digest is [sha256:9c9b9685ad319b9747c3fe69b46a61c11a0efabdfa09ca6a8b0c3da421036d27]
+// Source bundle `roots.pem` digest is [sha256:26bd8c0e7c962d940ac0f578af5630cc39ee3a7322af6bc16d4eb038232f466e]
 
 /* subject: Common Name: Baltimore CyberTrust Root, Organizational Unit: CyberTrust, Organization: Baltimore, Country: IE */
 /* issuer: Common Name: Baltimore CyberTrust Root, Organizational Unit: CyberTrust, Organization: Baltimore, Country: IE */
@@ -1663,80 +1663,6 @@ const unsigned char kCertificateWithFingerprint_c3846bf24b9e93ca64274c0ec67c1ecc
 0x7F,0xDB,0xBD,0x9F,
 };
 
-/* subject: Common Name: AAA Certificate Services, Organization: Comodo CA Limited, Locality: Salford, State/Province: Greater Manchester, Country: GB */
-/* issuer: Common Name: AAA Certificate Services, Organization: Comodo CA Limited, Locality: Salford, State/Province: Greater Manchester, Country: GB */
-/* link: https://crt.sh/?q=d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4 */
-const unsigned char kCertificateWithFingerprint_d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4_certificate[1078]={
-0x30,0x82,0x04,0x32,0x30,0x82,0x03,0x1A,0xA0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
-0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x05,0x05,0x00,0x30,
-0x7B,0x31,0x0B,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x47,0x42,0x31,0x1B,
-0x30,0x19,0x06,0x03,0x55,0x04,0x08,0x0C,0x12,0x47,0x72,0x65,0x61,0x74,0x65,0x72,
-0x20,0x4D,0x61,0x6E,0x63,0x68,0x65,0x73,0x74,0x65,0x72,0x31,0x10,0x30,0x0E,0x06,
-0x03,0x55,0x04,0x07,0x0C,0x07,0x53,0x61,0x6C,0x66,0x6F,0x72,0x64,0x31,0x1A,0x30,
-0x18,0x06,0x03,0x55,0x04,0x0A,0x0C,0x11,0x43,0x6F,0x6D,0x6F,0x64,0x6F,0x20,0x43,
-0x41,0x20,0x4C,0x69,0x6D,0x69,0x74,0x65,0x64,0x31,0x21,0x30,0x1F,0x06,0x03,0x55,
-0x04,0x03,0x0C,0x18,0x41,0x41,0x41,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,
-0x61,0x74,0x65,0x20,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x30,0x1E,0x17,0x0D,
-0x30,0x34,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5A,0x17,0x0D,0x32,
-0x38,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,0x39,0x5A,0x30,0x7B,0x31,0x0B,
-0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x47,0x42,0x31,0x1B,0x30,0x19,0x06,
-0x03,0x55,0x04,0x08,0x0C,0x12,0x47,0x72,0x65,0x61,0x74,0x65,0x72,0x20,0x4D,0x61,
-0x6E,0x63,0x68,0x65,0x73,0x74,0x65,0x72,0x31,0x10,0x30,0x0E,0x06,0x03,0x55,0x04,
-0x07,0x0C,0x07,0x53,0x61,0x6C,0x66,0x6F,0x72,0x64,0x31,0x1A,0x30,0x18,0x06,0x03,
-0x55,0x04,0x0A,0x0C,0x11,0x43,0x6F,0x6D,0x6F,0x64,0x6F,0x20,0x43,0x41,0x20,0x4C,
-0x69,0x6D,0x69,0x74,0x65,0x64,0x31,0x21,0x30,0x1F,0x06,0x03,0x55,0x04,0x03,0x0C,
-0x18,0x41,0x41,0x41,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x65,
-0x20,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x30,0x82,0x01,0x22,0x30,0x0D,0x06,
-0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x01,0x0F,
-0x00,0x30,0x82,0x01,0x0A,0x02,0x82,0x01,0x01,0x00,0xBE,0x40,0x9D,0xF4,0x6E,0xE1,
-0xEA,0x76,0x87,0x1C,0x4D,0x45,0x44,0x8E,0xBE,0x46,0xC8,0x83,0x06,0x9D,0xC1,0x2A,
-0xFE,0x18,0x1F,0x8E,0xE4,0x02,0xFA,0xF3,0xAB,0x5D,0x50,0x8A,0x16,0x31,0x0B,0x9A,
-0x06,0xD0,0xC5,0x70,0x22,0xCD,0x49,0x2D,0x54,0x63,0xCC,0xB6,0x6E,0x68,0x46,0x0B,
-0x53,0xEA,0xCB,0x4C,0x24,0xC0,0xBC,0x72,0x4E,0xEA,0xF1,0x15,0xAE,0xF4,0x54,0x9A,
-0x12,0x0A,0xC3,0x7A,0xB2,0x33,0x60,0xE2,0xDA,0x89,0x55,0xF3,0x22,0x58,0xF3,0xDE,
-0xDC,0xCF,0xEF,0x83,0x86,0xA2,0x8C,0x94,0x4F,0x9F,0x68,0xF2,0x98,0x90,0x46,0x84,
-0x27,0xC7,0x76,0xBF,0xE3,0xCC,0x35,0x2C,0x8B,0x5E,0x07,0x64,0x65,0x82,0xC0,0x48,
-0xB0,0xA8,0x91,0xF9,0x61,0x9F,0x76,0x20,0x50,0xA8,0x91,0xC7,0x66,0xB5,0xEB,0x78,
-0x62,0x03,0x56,0xF0,0x8A,0x1A,0x13,0xEA,0x31,0xA3,0x1E,0xA0,0x99,0xFD,0x38,0xF6,
-0xF6,0x27,0x32,0x58,0x6F,0x07,0xF5,0x6B,0xB8,0xFB,0x14,0x2B,0xAF,0xB7,0xAA,0xCC,
-0xD6,0x63,0x5F,0x73,0x8C,0xDA,0x05,0x99,0xA8,0x38,0xA8,0xCB,0x17,0x78,0x36,0x51,
-0xAC,0xE9,0x9E,0xF4,0x78,0x3A,0x8D,0xCF,0x0F,0xD9,0x42,0xE2,0x98,0x0C,0xAB,0x2F,
-0x9F,0x0E,0x01,0xDE,0xEF,0x9F,0x99,0x49,0xF1,0x2D,0xDF,0xAC,0x74,0x4D,0x1B,0x98,
-0xB5,0x47,0xC5,0xE5,0x29,0xD1,0xF9,0x90,0x18,0xC7,0x62,0x9C,0xBE,0x83,0xC7,0x26,
-0x7B,0x3E,0x8A,0x25,0xC7,0xC0,0xDD,0x9D,0xE6,0x35,0x68,0x10,0x20,0x9D,0x8F,0xD8,
-0xDE,0xD2,0xC3,0x84,0x9C,0x0D,0x5E,0xE8,0x2F,0xC9,0x02,0x03,0x01,0x00,0x01,0xA3,
-0x81,0xC0,0x30,0x81,0xBD,0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,0x16,0x04,0x14,
-0xA0,0x11,0x0A,0x23,0x3E,0x96,0xF1,0x07,0xEC,0xE2,0xAF,0x29,0xEF,0x82,0xA5,0x7F,
-0xD0,0x30,0xA4,0xB4,0x30,0x0E,0x06,0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,0x04,
-0x03,0x02,0x01,0x06,0x30,0x0F,0x06,0x03,0x55,0x1D,0x13,0x01,0x01,0xFF,0x04,0x05,
-0x30,0x03,0x01,0x01,0xFF,0x30,0x7B,0x06,0x03,0x55,0x1D,0x1F,0x04,0x74,0x30,0x72,
-0x30,0x38,0xA0,0x36,0xA0,0x34,0x86,0x32,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x63,
-0x72,0x6C,0x2E,0x63,0x6F,0x6D,0x6F,0x64,0x6F,0x63,0x61,0x2E,0x63,0x6F,0x6D,0x2F,
-0x41,0x41,0x41,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x65,0x53,0x65,
-0x72,0x76,0x69,0x63,0x65,0x73,0x2E,0x63,0x72,0x6C,0x30,0x36,0xA0,0x34,0xA0,0x32,
-0x86,0x30,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x63,0x72,0x6C,0x2E,0x63,0x6F,0x6D,
-0x6F,0x64,0x6F,0x2E,0x6E,0x65,0x74,0x2F,0x41,0x41,0x41,0x43,0x65,0x72,0x74,0x69,
-0x66,0x69,0x63,0x61,0x74,0x65,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x2E,0x63,
-0x72,0x6C,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x05,0x05,
-0x00,0x03,0x82,0x01,0x01,0x00,0x08,0x56,0xFC,0x02,0xF0,0x9B,0xE8,0xFF,0xA4,0xFA,
-0xD6,0x7B,0xC6,0x44,0x80,0xCE,0x4F,0xC4,0xC5,0xF6,0x00,0x58,0xCC,0xA6,0xB6,0xBC,
-0x14,0x49,0x68,0x04,0x76,0xE8,0xE6,0xEE,0x5D,0xEC,0x02,0x0F,0x60,0xD6,0x8D,0x50,
-0x18,0x4F,0x26,0x4E,0x01,0xE3,0xE6,0xB0,0xA5,0xEE,0xBF,0xBC,0x74,0x54,0x41,0xBF,
-0xFD,0xFC,0x12,0xB8,0xC7,0x4F,0x5A,0xF4,0x89,0x60,0x05,0x7F,0x60,0xB7,0x05,0x4A,
-0xF3,0xF6,0xF1,0xC2,0xBF,0xC4,0xB9,0x74,0x86,0xB6,0x2D,0x7D,0x6B,0xCC,0xD2,0xF3,
-0x46,0xDD,0x2F,0xC6,0xE0,0x6A,0xC3,0xC3,0x34,0x03,0x2C,0x7D,0x96,0xDD,0x5A,0xC2,
-0x0E,0xA7,0x0A,0x99,0xC1,0x05,0x8B,0xAB,0x0C,0x2F,0xF3,0x5C,0x3A,0xCF,0x6C,0x37,
-0x55,0x09,0x87,0xDE,0x53,0x40,0x6C,0x58,0xEF,0xFC,0xB6,0xAB,0x65,0x6E,0x04,0xF6,
-0x1B,0xDC,0x3C,0xE0,0x5A,0x15,0xC6,0x9E,0xD9,0xF1,0x59,0x48,0x30,0x21,0x65,0x03,
-0x6C,0xEC,0xE9,0x21,0x73,0xEC,0x9B,0x03,0xA1,0xE0,0x37,0xAD,0xA0,0x15,0x18,0x8F,
-0xFA,0xBA,0x02,0xCE,0xA7,0x2C,0xA9,0x10,0x13,0x2C,0xD4,0xE5,0x08,0x26,0xAB,0x22,
-0x97,0x60,0xF8,0x90,0x5E,0x74,0xD4,0xA2,0x9A,0x53,0xBD,0xF2,0xA9,0x68,0xE0,0xA2,
-0x6E,0xC2,0xD7,0x6C,0xB1,0xA3,0x0F,0x9E,0xBF,0xEB,0x68,0xE7,0x56,0xF2,0xAE,0xF2,
-0xE3,0x2B,0x38,0x3A,0x09,0x81,0xB5,0x6B,0x85,0xD7,0xBE,0x2D,0xED,0x3F,0x1A,0xB7,
-0xB2,0x63,0xE2,0xF5,0x62,0x2C,0x82,0xD4,0x6A,0x00,0x41,0x50,0xF1,0x39,0x83,0x9F,
-0x95,0xE9,0x36,0x96,0x98,0x6E,
-};
-
 /* subject: Common Name: COMODO Certification Authority, Organization: COMODO CA Limited, Locality: Salford, State/Province: Greater Manchester, Country: GB */
 /* issuer: Common Name: COMODO Certification Authority, Organization: COMODO CA Limited, Locality: Salford, State/Province: Greater Manchester, Country: GB */
 /* link: https://crt.sh/?q=0c2cd63df7806fa399ede809116b575bf87989f06518f9808c860503178baf66 */
@@ -2404,7 +2330,7 @@ const unsigned char kCertificateWithFingerprint_b085d70b964f191a73e4af0d54ae7a0e
 0x37,0x98,0xBC,0xA3,0x8F,0x4C,0x4C,0xA9,0x34,0x2B,0x6C,0xEF,0xFB,0x95,0x9B,0x26,
 };
 
-const unsigned char* const kSSLCertCertificateList[36]={
+const unsigned char* const kSSLCertCertificateList[35]={
 kCertificateWithFingerprint_16af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb_certificate,
 kCertificateWithFingerprint_3e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c_certificate,
 kCertificateWithFingerprint_7d05ebb682339f8c9451ee094eebfefa7953a114edb2f44949452fab7d2fc185_certificate,
@@ -2430,7 +2356,6 @@ kCertificateWithFingerprint_45140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749d
 kCertificateWithFingerprint_2ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f5_certificate,
 kCertificateWithFingerprint_1465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658_certificate,
 kCertificateWithFingerprint_c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4_certificate,
-kCertificateWithFingerprint_d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4_certificate,
 kCertificateWithFingerprint_0c2cd63df7806fa399ede809116b575bf87989f06518f9808c860503178baf66_certificate,
 kCertificateWithFingerprint_1793927a0614549789adce2f8f34f7f0b66d0f3ae3a3b84d21ec15dbba4fadc7_certificate,
 kCertificateWithFingerprint_52f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234_certificate,
@@ -2443,7 +2368,7 @@ kCertificateWithFingerprint_349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556c
 kCertificateWithFingerprint_b085d70b964f191a73e4af0d54ae7a0e07aafdaf9b71dd0862138ab7325a24a2_certificate,
 };
 
-const size_t kSSLCertCertificateSizeList[36]={
+const size_t kSSLCertCertificateSizeList[35]={
 891,
 955,
 922,
@@ -2469,7 +2394,6 @@ const size_t kSSLCertCertificateSizeList[36]={
 993,
 1043,
 1028,
-1078,
 1057,
 653,
 1500,
diff --git a/Source/ThirdParty/libwebrtc/Source/webrtc/tools_webrtc/sslroots/generate_sslroots.py b/Source/ThirdParty/libwebrtc/Source/webrtc/tools_webrtc/sslroots/generate_sslroots.py
index 14acff92fb26d..7d482bd9d6033 100644
--- a/Source/ThirdParty/libwebrtc/Source/webrtc/tools_webrtc/sslroots/generate_sslroots.py
+++ b/Source/ThirdParty/libwebrtc/Source/webrtc/tools_webrtc/sslroots/generate_sslroots.py
@@ -224,6 +224,7 @@ def _CreateOutputHeader(source_path_or_url: str, source_digest: str) -> str:
       ' */\n\n'
       '#ifndef RTC_BASE_SSL_ROOTS_H_\n'
       '#define RTC_BASE_SSL_ROOTS_H_\n\n'
+      '#include <cstddef>\n\n'
       '// This file is the root certificates in C form.\n\n'
       f'// It was generated at {now_utc.isoformat()} by the following script:\n'
       '// `tools_webrtc/sslroots/generate_sslroots.py '
diff --git a/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py b/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py
index d3b7aad05e9ae..64d8a83dfccb9 100644
--- a/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py
+++ b/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py
@@ -61,7 +61,7 @@
 else:
     AutoInstall.register(Package('setuptools', Version(59, 8, 0), aliases=['_distutils_hack', 'pkg_resources']))
 
-AutoInstall.register(Package('certifi', Version(2022, 12, 7)))
+AutoInstall.register(Package('certifi', Version(2026, 10, 19)))
 AutoInstall.register(Package('chardet', Version(3, 0, 4)))
 AutoInstall.register(Package('dateutil', Version(2, 8, 1), pypi_name='python-dateutil', wheel=True))
 AutoInstall.register(Package('entrypoints', Version(0, 3, 0)))
diff --git a/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/cacert.pem b/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/cacert.pem
index 6b44131437241..02075d8ea1166 100644
--- a/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/cacert.pem
+++ b/Tools/Scripts/libraries/webkitcorepy/webkitcorepy/cacert.pem
@@ -120,31 +120,6 @@ serial=01
 SHA256 Fingerprint=D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4
 notBefore=Jan  1 00:00:00 2004 GMT
 notAfter=Dec 31 23:59:59 2028 GMT
------BEGIN CERTIFICATE-----
-MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
-MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
-GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
-YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
-MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
-BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
-GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
-BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
-3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
-YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
-rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
-ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
-oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
-MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
-QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
-b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
-AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
-GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
-Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
-G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
-l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
-smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
------END CERTIFICATE-----
 
 issuer= /C=US/O=Internet Security Research Group/CN=ISRG Root X1
 subject= /C=US/O=Internet Security Research Group/CN=ISRG Root X1