[build] Update Selenium Grid 4.49.0 (#3240)

* [build] Update Selenium Grid 4.49.0

* [test] Make the exporter session fixture immune to the release-day sed

The three session tests in the exporter have been failing on trunk since
5589297, and not because of anything in the exporter:

  --- FAIL: TestCollectFullSnapshot
      selenium_grid_session_start_seconds{s1} missing
  --- FAIL: TestSessionLifecycle
      start_seconds missing while session active
  --- FAIL: TestSessionDurationFallback
      fallback duration = 0, want > 0

The fixture's startTime literal was corrupt, so parseGridTime returned 0 and
every metric derived from it disappeared.

It was corrupted by update_tag_in_docs_and_files.sh. That script rewrites the
whole tree with unescaped sed substitutions whose patterns are version strings,
and KEDA_TAG_PREV_VERSION and KEDA_TAG_VERSION are both 2.20.1 (Makefile:33,35).
So it runs what looks like a no-op:

  sed -i "s/2.20.1/2.20.1/g"

In a regex `.` is any character, so that pattern matches a run of digits and
separators inside a formatted timestamp and replaces it with the literal version
string. The substitution is destructive even though the two sides are identical.

This is the second time. #3202 repaired the same literal after the 4.47.0
release; the 4.48.0 release broke it straight back. Repairing the literal again
would just queue up a third.

So the fixture no longer contains a timestamp-shaped literal at all: the start
time is built with time.Date and rendered through gridDateFormat, the same
constant the parser uses, and the expected unix value is derived from it rather
than hardcoded so the two cannot drift. A value that only exists at runtime
cannot be corrupted by a sed over the source. The explanatory comment describes
the vulnerable strings rather than quoting them, because quoting them made the
comment itself get rewritten.

Verified by replaying the script's substitutions over the file with the real
previous tag: the file comes back byte-identical, and `go test -race` passes at
95.8% coverage.

The underlying hazard is not fixed here and still applies tree-wide: the ffmpeg,
LATEST_TAG and LATEST_DATE substitutions are unescaped too, and the KEDA and
ffmpeg pairs are currently identical so both are pure no-ops that can only do
damage. Guarding each substitution on PREV != VERSION and escaping the patterns
belongs in its own change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013CTYeQSAs9vEpdGevEcVQE

---------

Co-authored-by: Selenium CI Bot <selenium-ci@users.noreply.github.com>
Co-authored-by: Viet Nguyen Duc <nguyenducviet4496@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/release-chrome-for-testing-versions.yml

@@ -31,7 +31,7 @@ on:
       browser-versions:
         description: 'List browser version to build. E.g: [130, 131]'
         required: true
-        default: '[113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152]'
+        default: '[113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153]'
       push-image:
         description: 'Push image after testing successfully'
         required: true

.github/workflows/release-chrome-versions.yml

@@ -31,7 +31,7 @@ on:
       browser-versions:
         description: 'List browser version to build. E.g: [130, 131]'
         required: true
-        default: '[95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152]'
+        default: '[95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153]'
       push-image:
         description: 'Push image after testing successfully'
         required: true

.github/workflows/release-edge-versions.yml

@@ -31,7 +31,7 @@ on:
       browser-versions:
         description: 'List browser version to build. E.g: [130, 131]'
         required: true
-        default: '[114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152]'
+        default: '[114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153]'
       push-image:
         description: 'Push image after testing successfully'
         required: true

.github/workflows/release-firefox-versions.yml

@@ -31,7 +31,7 @@ on:
       browser-versions:
         description: 'List browser version to build. E.g: [130, 131]'
         required: true
-        default: '[98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155]'
+        default: '[98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156]'
       push-image:
         description: 'Push image after testing successfully'
         required: true

.keda-external-scaler/go.mod

@@ -9,8 +9,8 @@ require (
 )
 
 require (
-	golang.org/x/net v0.58.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260911204522-f61a6ca850bd // indirect
 )

.keda-external-scaler/go.sum

@@ -22,16 +22,16 @@ go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRk
 go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
 go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
 go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 h1:5t+ZydAFj5kGVLrgCvLmpmCf9ylGRd64hpEronfRaws=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260911204522-f61a6ca850bd h1:29LZPNIJg+GEmJwZXruJJRwqy/wnWAYZXDtROToV/aQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260911204522-f61a6ca850bd/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
 google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
 google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

.monitoring/exporter/collector_test.go

@@ -52,21 +52,39 @@ func (s *swapServer) set(body string) {
 
 func (s *swapServer) close() { s.srv.Close() }
 
+// chromeSessionStart is the canonical session start used across the collector
+// tests. It is built with time.Date and rendered through gridDateFormat rather
+// than written out as a literal timestamp, so that no timestamp-shaped string
+// exists in this file at all.
+//
+// That is deliberate, not style. update_tag_in_docs_and_files.sh rewrites the
+// whole tree on every release with unescaped `sed` substitutions whose patterns
+// are version strings, and in a regex `.` matches any character. So the KEDA tag
+// pattern 2.20.1 also matches a run of digits and separators inside a formatted
+// timestamp, and rewrites that run to the literal version string. The timestamp
+// literal this replaced was corrupted exactly that way by the 4.47.0 release,
+// fixed in #3202, then corrupted again by the 4.48.0 release.
+//
+// A value that only exists at runtime cannot be corrupted by a sed over the
+// source, which is why the examples above are described rather than quoted.
+var chromeSessionStart = time.Date(1987, time.June, 5, 4, 3, 2, 0, time.UTC)
+
+// chromeSessionStartUnix is derived, never hardcoded, so the fixture and the
+// expectation cannot drift apart.
+var chromeSessionStartUnix = float64(chromeSessionStart.Unix())
+
 // chromeSession is the canonical active session used across the collector tests.
-// startTime 02/01/2.20.10:00:00 UTC == unix 1577959200.
 func chromeSession(t *testing.T) sessionEntry {
 	return sessionEntry{
 		ID:                    "s1",
 		Capabilities:          encode(t, caps{BrowserName: "chrome", BrowserVersion: "124", PlatformName: "linux", TestName: "login-test", ContainerName: "node-chrome-1"}),
-		StartTime:             "02/01/2.20.10:00:00",
+		StartTime:             chromeSessionStart.Format(gridDateFormat),
 		SessionDurationMillis: "42300",
 		NodeID:                "node-up",
 		NodeURI:               "http://node1:5555",
 	}
 }
 
-const chromeSessionStartUnix = 1577959200
-
 // gridResponse renders a full GraphQL data envelope with the given sessions and
 // queue. Two nodes are always present: one UP (chrome), one DRAINING (firefox).
 func gridResponse(t *testing.T, sessions []sessionEntry, queue []string) string {
@@ -273,7 +291,7 @@ func TestCollectFullSnapshot(t *testing.T) {
 	if m, ok := series(mfs, "selenium_grid_session_start_seconds", sessLabels); !ok {
 		t.Error("selenium_grid_session_start_seconds{s1} missing")
 	} else if v := metricValue(m); v != chromeSessionStartUnix {
-		t.Errorf("session_start_seconds = %v, want %d", v, chromeSessionStartUnix)
+		t.Errorf("session_start_seconds = %v, want %v", v, chromeSessionStartUnix)
 	}
 	if m, ok := series(mfs, "selenium_grid_session_duration_seconds", sessLabels); !ok {
 		t.Error("selenium_grid_session_duration_seconds{s1} missing")
@@ -344,7 +362,7 @@ func TestSessionDurationFallback(t *testing.T) {
 	if !ok {
 		t.Fatal("session_duration_seconds{s1} missing")
 	}
-	// startTime is in 2020, so wall-clock duration is a large positive number.
+	// chromeSessionStart is well in the past, so wall-clock duration is a large positive number.
 	if v := metricValue(m); v <= 0 {
 		t.Errorf("fallback duration = %v, want > 0", v)
 	}

.monitoring/exporter/go.mod

@@ -14,6 +14,6 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/prometheus/common v0.71.0 // indirect
 	github.com/prometheus/procfs v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 )

.monitoring/exporter/go.sum

@@ -26,7 +26,7 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

Makefile

@@ -1,12 +1,12 @@
 NAME := $(or $(NAME),$(NAME),selenium)
 CURRENT_DATE := $(shell date '+%Y%m%d')
 BUILD_DATE := $(or $(BUILD_DATE),$(BUILD_DATE),$(CURRENT_DATE))
-BASE_RELEASE := $(or $(BASE_RELEASE),$(BASE_RELEASE),selenium-4.48.0)
-BASE_VERSION := $(or $(BASE_VERSION),$(BASE_VERSION),4.48.0)
-BINDING_VERSION := $(or $(BINDING_VERSION),$(BINDING_VERSION),4.48.0)
+BASE_RELEASE := $(or $(BASE_RELEASE),$(BASE_RELEASE),selenium-4.49.0)
+BASE_VERSION := $(or $(BASE_VERSION),$(BASE_VERSION),4.49.0)
+BINDING_VERSION := $(or $(BINDING_VERSION),$(BINDING_VERSION),4.49.0)
 BASE_RELEASE_NIGHTLY := $(or $(BASE_RELEASE_NIGHTLY),$(BASE_RELEASE_NIGHTLY),nightly)
-BASE_VERSION_NIGHTLY := $(or $(BASE_VERSION_NIGHTLY),$(BASE_VERSION_NIGHTLY),4.49.0-SNAPSHOT)
-VERSION := $(or $(VERSION),$(VERSION),4.48.0)
+BASE_VERSION_NIGHTLY := $(or $(BASE_VERSION_NIGHTLY),$(BASE_VERSION_NIGHTLY),4.50.0-SNAPSHOT)
+VERSION := $(or $(VERSION),$(VERSION),4.49.0)
 MVN_SELENIUM_VERSION := $(or $(MVN_SELENIUM_VERSION),$(MVN_SELENIUM_VERSION),latest.release)
 TAG_VERSION := $(VERSION)-$(BUILD_DATE)
 CHART_VERSION_NIGHTLY := $(or $(CHART_VERSION_NIGHTLY),$(CHART_VERSION_NIGHTLY),1.0.0-nightly)
@@ -188,7 +188,7 @@ mark_ci_images_complete:
 #
 # Most, not all. NodeDocker/config.toml and NodeKubernetes/config.toml name the
 # exact standalone tags of the release being made -
-#   "selenium/standalone-chrome:4.48.0-20260905"
+#   "selenium/standalone-chrome:4.49.0-20260905"
 # - and update_tag_in_docs_and_files.sh rewrites them as part of tagging. Those
 # two images cannot exist before the tag does, nor can the two standalones built
 # FROM them, so those four are still built at release time.
@@ -377,7 +377,7 @@ check_dockerhub_description:
 
 # Reproduce the nightly image scan locally for one image, e.g.
 #   make scan_image_scout IMAGE=base
-#   make scan_image_scout IMAGE=node-chrome TAG=4.48.0-20260909
+#   make scan_image_scout IMAGE=node-chrome TAG=4.49.0-20260909
 # Needs `docker login`; Docker Scout must be enabled for the repository.
 scan_image_scout:
 	docker scout cves --only-fixed --format sarif \