@@ 5,20 5,11 @@ name.
 
 --- a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
 +++ b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
-@@ -3606,6 +3606,7 @@
+@@ -3753,6 +3753,7 @@
      if (
        newAddon ||
        oldAddon.updateDate != xpiState.mtime ||
 +      oldAddon.path != xpiState.path ||
-       (aUpdateCompatibility && this.isAppBundledLocation(installLocation))
-     ) {
-       newAddon = this.updateMetadata(
-@@ -3614,8 +3615,6 @@
-         xpiState,
-         newAddon
-       );
--    } else if (oldAddon.path != xpiState.path) {
--      newAddon = this.updatePath(installLocation, oldAddon, xpiState);
-     } else if (aUpdateCompatibility || aSchemaChange) {
-       newAddon = this.updateCompatibility(
-         installLocation,
+       (aUpdateCompatibility && this.isAppBundledLocation(installLocation)) ||
+       // update addon metadata if the addon in bundled into
+       // the omni jar and version or the resource URI pointing


@@ 3,7 3,7 @@ native manifests) with "$ICECAT_SYSTEM_DIR".
 
 --- a/toolkit/xre/nsXREDirProvider.cpp
 +++ b/toolkit/xre/nsXREDirProvider.cpp
-@@ -296,24 +296,12 @@ nsresult nsXREDirProvider::GetBackgroundTasksProfilesRootDir(
+@@ -287,24 +287,11 @@
  static nsresult GetSystemParentDirectory(nsIFile** aFile) {
    nsresult rv;
    nsCOMPtr<nsIFile> localDir;


@@ 23,14 23,13 @@ native manifests) with "$ICECAT_SYSTEM_DIR".
 -      "/usr/lib/mozilla"_ns
 -#    endif
 -      ;
--  rv = NS_NewNativeLocalFile(dirname, false, getter_AddRefs(localDir));
+-  rv = NS_NewNativeLocalFile(dirname, getter_AddRefs(localDir));
 -#  endif
-+
 +  const char* systemParentDir = getenv("ICECAT_SYSTEM_DIR");
 +  if (!systemParentDir || !*systemParentDir) return NS_ERROR_FAILURE;
 +
-+  rv = NS_NewNativeLocalFile(nsDependentCString(systemParentDir), false,
++  rv = NS_NewNativeLocalFile(nsDependentCString(systemParentDir),
 +                             getter_AddRefs(localDir));
- 
+
    if (NS_SUCCEEDED(rv)) {
      localDir.forget(aFile);


@@ 15,17 15,19 @@ See: <https://bugzilla.mozilla.org/show_bug.cgi?id=1848615#c8>,
 <https://issues.guix.gnu.org/38045> and
 <https://issues.guix.gnu.org/77559>
 
+diff --git a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
+index 4eff5e6..42171eb 100644
 --- a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
 +++ b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-@@ -452,6 +452,7 @@
+@@ -476,6 +476,7 @@ void SandboxBrokerPolicyFactory::InitContentPolicy() {
    // Various places where fonts reside
-   policy->AddDir(rdonly, "/usr/X11R6/lib/X11/fonts");
-   policy->AddDir(rdonly, "/nix/store");
-+  policy->AddDir(rdonly, "/gnu/store");
+   policy->AddTree(rdonly, "/usr/X11R6/lib/X11/fonts");
+   policy->AddTree(rdonly, "/nix/store");
++  policy->AddTree(rdonly, "/gnu/store");
    // https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/e434e680d22260f277f4a30ec4660ed32b591d16/files/fontconfig-flatpak.conf
-   policy->AddDir(rdonly, "/run/host/fonts");
-   policy->AddDir(rdonly, "/run/host/user-fonts");
-@@ -461,6 +462,7 @@
+   policy->AddTree(rdonly, "/run/host/fonts");
+   policy->AddTree(rdonly, "/run/host/user-fonts");
+@@ -485,6 +486,7 @@ void SandboxBrokerPolicyFactory::InitContentPolicy() {
    // Bug 1848615
    policy->AddPath(rdonly, "/usr");
    policy->AddPath(rdonly, "/nix");


@@ 33,19 35,19 @@ See: <https://bugzilla.mozilla.org/show_bug.cgi?id=1848615#c8>,
  
    AddLdconfigPaths(policy);
    AddLdLibraryEnvPaths(policy);
-@@ -920,6 +922,7 @@
-   policy->AddDir(rdonly, "/usr/lib64");
-   policy->AddDir(rdonly, "/run/opengl-driver/lib");
-   policy->AddDir(rdonly, "/nix/store");
-+  policy->AddDir(rdonly, "/gnu/store");
+@@ -934,6 +936,7 @@ SandboxBrokerPolicyFactory::GetRDDPolicy(int aPid) {
+   policy->AddTree(rdonly, "/usr/lib64");
+   policy->AddTree(rdonly, "/run/opengl-driver/lib");
+   policy->AddTree(rdonly, "/nix/store");
++  policy->AddTree(rdonly, "/gnu/store");
  
    // Bug 1647957: memory reporting.
    AddMemoryReporting(policy.get(), aPid);
-@@ -1043,6 +1046,7 @@
+@@ -1079,6 +1082,7 @@ SandboxBrokerPolicyFactory::GetUtilityProcessPolicy(int aPid) {
    // Required to make sure ffmpeg loads properly, this is already existing on
    // Content and RDD
-   policy->AddDir(rdonly, "/nix/store");
-+  policy->AddDir(rdonly, "/gnu/store");
+   policy->AddTree(rdonly, "/nix/store");
++  policy->AddTree(rdonly, "/gnu/store");
  
    // glibc will try to stat64("/") while populating nsswitch database
    // https://sourceware.org/git/?p=glibc.git;a=blob;f=nss/nss_database.c;h=cf0306adc47f12d9bc761ab1b013629f4482b7e6;hb=9826b03b747b841f5fc6de2054bf1ef3f5c4bdf3#l396