diff --git a/mozjs-sys/Cargo.toml b/mozjs-sys/Cargo.toml
index 43a40af04f..ec647fc386 100644
--- a/mozjs-sys/Cargo.toml
+++ b/mozjs-sys/Cargo.toml
@@ -2,7 +2,7 @@
 name = "mozjs_sys"
 description = "System crate for the Mozilla SpiderMonkey JavaScript engine."
 repository.workspace = true
-version = "0.128.3-9"
+version = "0.128.6-0"
 authors = ["Mozilla"]
 links = "mozjs"
 build = "build.rs"
diff --git a/mozjs-sys/etc/COMMIT b/mozjs-sys/etc/COMMIT
index f86ab5a223..6486549344 100644
--- a/mozjs-sys/etc/COMMIT
+++ b/mozjs-sys/etc/COMMIT
@@ -1 +1 @@
-e2cb3d9c8cfc18acad7f77add351416dc95b67c4
+4f008c71b12e001ae54b7fcd4787b266764c28bf
diff --git a/mozjs-sys/mozjs/.cargo/config.toml.in b/mozjs-sys/mozjs/.cargo/config.toml.in
index 99400f9ccb..827f912774 100644
--- a/mozjs-sys/mozjs/.cargo/config.toml.in
+++ b/mozjs-sys/mozjs/.cargo/config.toml.in
@@ -90,11 +90,6 @@ git = "https://github.com/mozilla/mp4parse-rust"
 rev = "a138e40ec1c603615873e524b5b22e11c0ec4820"
 replace-with = "vendored-sources"
 
-[source."git+https://github.com/mozilla/neqo?tag=v0.7.9"]
-git = "https://github.com/mozilla/neqo"
-tag = "v0.7.9"
-replace-with = "vendored-sources"
-
 [source."git+https://github.com/seanmonstar/warp?rev=9d081461ae1167eb321585ce424f4fef6cf0092b"]
 git = "https://github.com/seanmonstar/warp"
 rev = "9d081461ae1167eb321585ce424f4fef6cf0092b"
diff --git a/mozjs-sys/mozjs/Cargo.lock b/mozjs-sys/mozjs/Cargo.lock
index 3d988de4b1..eeeb9c33f8 100644
--- a/mozjs-sys/mozjs/Cargo.lock
+++ b/mozjs-sys/mozjs/Cargo.lock
@@ -3962,7 +3962,6 @@ dependencies = [
 [[package]]
 name = "neqo-bin"
 version = "0.7.9"
-source = "git+https://github.com/mozilla/neqo?tag=v0.7.9#121fe683ae4b39a5b694f671abfd397cbd9b4322"
 dependencies = [
  "clap",
  "clap-verbosity-flag",
@@ -3984,7 +3983,6 @@ dependencies = [
 [[package]]
 name = "neqo-common"
 version = "0.7.9"
-source = "git+https://github.com/mozilla/neqo?tag=v0.7.9#121fe683ae4b39a5b694f671abfd397cbd9b4322"
 dependencies = [
  "enum-map",
  "env_logger",
@@ -3997,7 +3995,6 @@ dependencies = [
 [[package]]
 name = "neqo-crypto"
 version = "0.7.9"
-source = "git+https://github.com/mozilla/neqo?tag=v0.7.9#121fe683ae4b39a5b694f671abfd397cbd9b4322"
 dependencies = [
  "bindgen 0.69.4",
  "log",
@@ -4012,7 +4009,6 @@ dependencies = [
 [[package]]
 name = "neqo-http3"
 version = "0.7.9"
-source = "git+https://github.com/mozilla/neqo?tag=v0.7.9#121fe683ae4b39a5b694f671abfd397cbd9b4322"
 dependencies = [
  "enumset",
  "log",
@@ -4029,7 +4025,6 @@ dependencies = [
 [[package]]
 name = "neqo-qpack"
 version = "0.7.9"
-source = "git+https://github.com/mozilla/neqo?tag=v0.7.9#121fe683ae4b39a5b694f671abfd397cbd9b4322"
 dependencies = [
  "log",
  "neqo-common",
@@ -4042,7 +4037,6 @@ dependencies = [
 [[package]]
 name = "neqo-transport"
 version = "0.7.9"
-source = "git+https://github.com/mozilla/neqo?tag=v0.7.9#121fe683ae4b39a5b694f671abfd397cbd9b4322"
 dependencies = [
  "enum-map",
  "indexmap 2.2.6",
diff --git a/mozjs-sys/mozjs/build/moz.configure/bootstrap.configure b/mozjs-sys/mozjs/build/moz.configure/bootstrap.configure
index 6e8e59812f..fb1275dad0 100755
--- a/mozjs-sys/mozjs/build/moz.configure/bootstrap.configure
+++ b/mozjs-sys/mozjs/build/moz.configure/bootstrap.configure
@@ -92,6 +92,7 @@ def bootstrap_toolchain_tasks(host):
         result = {
             "index": t.optimization["index-search"],
             "artifact": t.attributes["toolchain-artifact"],
+            "extract": t.attributes.get("toolchain-extract", True),
         }
         command = t.attributes.get("toolchain-command")
         if command:
@@ -219,6 +220,9 @@ def bootstrap_path(path, **kwargs):
                     "--from-task",
                     f"{task_id}:{artifact}",
                 ]
+                if not task["extract"]:
+                    command.append("--no-unpack")
+
             elif command:
                 # For private local toolchains, run the associated command.
                 command = (
diff --git a/mozjs-sys/mozjs/build/zstandard_requirements.in b/mozjs-sys/mozjs/build/zstandard_requirements.in
index 168042c4bc..e272596dbd 100644
--- a/mozjs-sys/mozjs/build/zstandard_requirements.in
+++ b/mozjs-sys/mozjs/build/zstandard_requirements.in
@@ -1,2 +1,2 @@
-zstandard==0.22.0
+zstandard==0.23.0
 
diff --git a/mozjs-sys/mozjs/build/zstandard_requirements.txt b/mozjs-sys/mozjs/build/zstandard_requirements.txt
index 7553ded463..fe73da4d53 100644
--- a/mozjs-sys/mozjs/build/zstandard_requirements.txt
+++ b/mozjs-sys/mozjs/build/zstandard_requirements.txt
@@ -4,51 +4,102 @@
 #
 #    pip-compile --generate-hashes --output-file=build/zstandard_requirements.txt build/zstandard_requirements.in
 #
-zstandard==0.22.0 \
-    --hash=sha256:11f0d1aab9516a497137b41e3d3ed4bbf7b2ee2abc79e5c8b010ad286d7464bd \
-    --hash=sha256:1958100b8a1cc3f27fa21071a55cb2ed32e9e5df4c3c6e661c193437f171cba2 \
-    --hash=sha256:1a90ba9a4c9c884bb876a14be2b1d216609385efb180393df40e5172e7ecf356 \
-    --hash=sha256:1d43501f5f31e22baf822720d82b5547f8a08f5386a883b32584a185675c8fbf \
-    --hash=sha256:23d2b3c2b8e7e5a6cb7922f7c27d73a9a615f0a5ab5d0e03dd533c477de23004 \
-    --hash=sha256:2612e9bb4977381184bb2463150336d0f7e014d6bb5d4a370f9a372d21916f69 \
-    --hash=sha256:275df437ab03f8c033b8a2c181e51716c32d831082d93ce48002a5227ec93019 \
-    --hash=sha256:2ac9957bc6d2403c4772c890916bf181b2653640da98f32e04b96e4d6fb3252a \
-    --hash=sha256:2b11ea433db22e720758cba584c9d661077121fcf60ab43351950ded20283440 \
-    --hash=sha256:2fdd53b806786bd6112d97c1f1e7841e5e4daa06810ab4b284026a1a0e484c0b \
-    --hash=sha256:33591d59f4956c9812f8063eff2e2c0065bc02050837f152574069f5f9f17775 \
-    --hash=sha256:36a47636c3de227cd765e25a21dc5dace00539b82ddd99ee36abae38178eff9e \
-    --hash=sha256:39b2853efc9403927f9065cc48c9980649462acbdf81cd4f0cb773af2fd734bc \
-    --hash=sha256:3db41c5e49ef73641d5111554e1d1d3af106410a6c1fb52cf68912ba7a343a0d \
-    --hash=sha256:445b47bc32de69d990ad0f34da0e20f535914623d1e506e74d6bc5c9dc40bb09 \
-    --hash=sha256:466e6ad8caefb589ed281c076deb6f0cd330e8bc13c5035854ffb9c2014b118c \
-    --hash=sha256:48f260e4c7294ef275744210a4010f116048e0c95857befb7462e033f09442fe \
-    --hash=sha256:4ac59d5d6910b220141c1737b79d4a5aa9e57466e7469a012ed42ce2d3995e88 \
-    --hash=sha256:53866a9d8ab363271c9e80c7c2e9441814961d47f88c9bc3b248142c32141d94 \
-    --hash=sha256:589402548251056878d2e7c8859286eb91bd841af117dbe4ab000e6450987e08 \
-    --hash=sha256:68953dc84b244b053c0d5f137a21ae8287ecf51b20872eccf8eaac0302d3e3b0 \
-    --hash=sha256:6c25b8eb733d4e741246151d895dd0308137532737f337411160ff69ca24f93a \
-    --hash=sha256:7034d381789f45576ec3f1fa0e15d741828146439228dc3f7c59856c5bcd3292 \
-    --hash=sha256:73a1d6bd01961e9fd447162e137ed949c01bdb830dfca487c4a14e9742dccc93 \
-    --hash=sha256:8226a33c542bcb54cd6bd0a366067b610b41713b64c9abec1bc4533d69f51e70 \
-    --hash=sha256:888196c9c8893a1e8ff5e89b8f894e7f4f0e64a5af4d8f3c410f0319128bb2f8 \
-    --hash=sha256:88c5b4b47a8a138338a07fc94e2ba3b1535f69247670abfe422de4e0b344aae2 \
-    --hash=sha256:8a1b2effa96a5f019e72874969394edd393e2fbd6414a8208fea363a22803b45 \
-    --hash=sha256:93e1856c8313bc688d5df069e106a4bc962eef3d13372020cc6e3ebf5e045202 \
-    --hash=sha256:9501f36fac6b875c124243a379267d879262480bf85b1dbda61f5ad4d01b75a3 \
-    --hash=sha256:959665072bd60f45c5b6b5d711f15bdefc9849dd5da9fb6c873e35f5d34d8cfb \
-    --hash=sha256:a1d67d0d53d2a138f9e29d8acdabe11310c185e36f0a848efa104d4e40b808e4 \
-    --hash=sha256:a493d470183ee620a3df1e6e55b3e4de8143c0ba1b16f3ded83208ea8ddfd91d \
-    --hash=sha256:a7ccf5825fd71d4542c8ab28d4d482aace885f5ebe4b40faaa290eed8e095a4c \
-    --hash=sha256:a88b7df61a292603e7cd662d92565d915796b094ffb3d206579aaebac6b85d5f \
-    --hash=sha256:a97079b955b00b732c6f280d5023e0eefe359045e8b83b08cf0333af9ec78f26 \
-    --hash=sha256:d22fdef58976457c65e2796e6730a3ea4a254f3ba83777ecfc8592ff8d77d303 \
-    --hash=sha256:d75f693bb4e92c335e0645e8845e553cd09dc91616412d1d4650da835b5449df \
-    --hash=sha256:d8593f8464fb64d58e8cb0b905b272d40184eac9a18d83cf8c10749c3eafcd7e \
-    --hash=sha256:d8fff0f0c1d8bc5d866762ae95bd99d53282337af1be9dc0d88506b340e74b73 \
-    --hash=sha256:de20a212ef3d00d609d0b22eb7cc798d5a69035e81839f549b538eff4105d01c \
-    --hash=sha256:e9e9d4e2e336c529d4c435baad846a181e39a982f823f7e4495ec0b0ec8538d2 \
-    --hash=sha256:f058a77ef0ece4e210bb0450e68408d4223f728b109764676e1a13537d056bb0 \
-    --hash=sha256:f1a4b358947a65b94e2501ce3e078bbc929b039ede4679ddb0460829b12f7375 \
-    --hash=sha256:f9b2cde1cd1b2a10246dbc143ba49d942d14fb3d2b4bccf4618d475c65464912 \
-    --hash=sha256:fe3390c538f12437b859d815040763abc728955a52ca6ff9c5d4ac707c4ad98e
+zstandard==0.23.0 \
+    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
+    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \
+    --hash=sha256:11e3bf3c924853a2d5835b24f03eeba7fc9b07d8ca499e247e06ff5676461a15 \
+    --hash=sha256:12a289832e520c6bd4dcaad68e944b86da3bad0d339ef7989fb7e88f92e96072 \
+    --hash=sha256:1516c8c37d3a053b01c1c15b182f3b5f5eef19ced9b930b684a73bad121addf4 \
+    --hash=sha256:157e89ceb4054029a289fb504c98c6a9fe8010f1680de0201b3eb5dc20aa6d9e \
+    --hash=sha256:1bfe8de1da6d104f15a60d4a8a768288f66aa953bbe00d027398b93fb9680b26 \
+    --hash=sha256:1e172f57cd78c20f13a3415cc8dfe24bf388614324d25539146594c16d78fcc8 \
+    --hash=sha256:1fd7e0f1cfb70eb2f95a19b472ee7ad6d9a0a992ec0ae53286870c104ca939e5 \
+    --hash=sha256:203d236f4c94cd8379d1ea61db2fce20730b4c38d7f1c34506a31b34edc87bdd \
+    --hash=sha256:27d3ef2252d2e62476389ca8f9b0cf2bbafb082a3b6bfe9d90cbcbb5529ecf7c \
+    --hash=sha256:29a2bc7c1b09b0af938b7a8343174b987ae021705acabcbae560166567f5a8db \
+    --hash=sha256:2ef230a8fd217a2015bc91b74f6b3b7d6522ba48be29ad4ea0ca3a3775bf7dd5 \
+    --hash=sha256:2ef3775758346d9ac6214123887d25c7061c92afe1f2b354f9388e9e4d48acfc \
+    --hash=sha256:2f146f50723defec2975fb7e388ae3a024eb7151542d1599527ec2aa9cacb152 \
+    --hash=sha256:2fb4535137de7e244c230e24f9d1ec194f61721c86ebea04e1581d9d06ea1269 \
+    --hash=sha256:32ba3b5ccde2d581b1e6aa952c836a6291e8435d788f656fe5976445865ae045 \
+    --hash=sha256:34895a41273ad33347b2fc70e1bff4240556de3c46c6ea430a7ed91f9042aa4e \
+    --hash=sha256:379b378ae694ba78cef921581ebd420c938936a153ded602c4fea612b7eaa90d \
+    --hash=sha256:38302b78a850ff82656beaddeb0bb989a0322a8bbb1bf1ab10c17506681d772a \
+    --hash=sha256:3aa014d55c3af933c1315eb4bb06dd0459661cc0b15cd61077afa6489bec63bb \
+    --hash=sha256:4051e406288b8cdbb993798b9a45c59a4896b6ecee2f875424ec10276a895740 \
+    --hash=sha256:40b33d93c6eddf02d2c19f5773196068d875c41ca25730e8288e9b672897c105 \
+    --hash=sha256:43da0f0092281bf501f9c5f6f3b4c975a8a0ea82de49ba3f7100e64d422a1274 \
+    --hash=sha256:445e4cb5048b04e90ce96a79b4b63140e3f4ab5f662321975679b5f6360b90e2 \
+    --hash=sha256:48ef6a43b1846f6025dde6ed9fee0c24e1149c1c25f7fb0a0585572b2f3adc58 \
+    --hash=sha256:50a80baba0285386f97ea36239855f6020ce452456605f262b2d33ac35c7770b \
+    --hash=sha256:519fbf169dfac1222a76ba8861ef4ac7f0530c35dd79ba5727014613f91613d4 \
+    --hash=sha256:53dd9d5e3d29f95acd5de6802e909ada8d8d8cfa37a3ac64836f3bc4bc5512db \
+    --hash=sha256:53ea7cdc96c6eb56e76bb06894bcfb5dfa93b7adcf59d61c6b92674e24e2dd5e \
+    --hash=sha256:576856e8594e6649aee06ddbfc738fec6a834f7c85bf7cadd1c53d4a58186ef9 \
+    --hash=sha256:59556bf80a7094d0cfb9f5e50bb2db27fefb75d5138bb16fb052b61b0e0eeeb0 \
+    --hash=sha256:5d41d5e025f1e0bccae4928981e71b2334c60f580bdc8345f824e7c0a4c2a813 \
+    --hash=sha256:61062387ad820c654b6a6b5f0b94484fa19515e0c5116faf29f41a6bc91ded6e \
+    --hash=sha256:61f89436cbfede4bc4e91b4397eaa3e2108ebe96d05e93d6ccc95ab5714be512 \
+    --hash=sha256:62136da96a973bd2557f06ddd4e8e807f9e13cbb0bfb9cc06cfe6d98ea90dfe0 \
+    --hash=sha256:64585e1dba664dc67c7cdabd56c1e5685233fbb1fc1966cfba2a340ec0dfff7b \
+    --hash=sha256:65308f4b4890aa12d9b6ad9f2844b7ee42c7f7a4fd3390425b242ffc57498f48 \
+    --hash=sha256:66b689c107857eceabf2cf3d3fc699c3c0fe8ccd18df2219d978c0283e4c508a \
+    --hash=sha256:6a41c120c3dbc0d81a8e8adc73312d668cd34acd7725f036992b1b72d22c1772 \
+    --hash=sha256:6f77fa49079891a4aab203d0b1744acc85577ed16d767b52fc089d83faf8d8ed \
+    --hash=sha256:72c68dda124a1a138340fb62fa21b9bf4848437d9ca60bd35db36f2d3345f373 \
+    --hash=sha256:752bf8a74412b9892f4e5b58f2f890a039f57037f52c89a740757ebd807f33ea \
+    --hash=sha256:76e79bc28a65f467e0409098fa2c4376931fd3207fbeb6b956c7c476d53746dd \
+    --hash=sha256:774d45b1fac1461f48698a9d4b5fa19a69d47ece02fa469825b442263f04021f \
+    --hash=sha256:77da4c6bfa20dd5ea25cbf12c76f181a8e8cd7ea231c673828d0386b1740b8dc \
+    --hash=sha256:77ea385f7dd5b5676d7fd943292ffa18fbf5c72ba98f7d09fc1fb9e819b34c23 \
+    --hash=sha256:80080816b4f52a9d886e67f1f96912891074903238fe54f2de8b786f86baded2 \
+    --hash=sha256:80a539906390591dd39ebb8d773771dc4db82ace6372c4d41e2d293f8e32b8db \
+    --hash=sha256:82d17e94d735c99621bf8ebf9995f870a6b3e6d14543b99e201ae046dfe7de70 \
+    --hash=sha256:837bb6764be6919963ef41235fd56a6486b132ea64afe5fafb4cb279ac44f259 \
+    --hash=sha256:84433dddea68571a6d6bd4fbf8ff398236031149116a7fff6f777ff95cad3df9 \
+    --hash=sha256:8c24f21fa2af4bb9f2c492a86fe0c34e6d2c63812a839590edaf177b7398f700 \
+    --hash=sha256:8ed7d27cb56b3e058d3cf684d7200703bcae623e1dcc06ed1e18ecda39fee003 \
+    --hash=sha256:9206649ec587e6b02bd124fb7799b86cddec350f6f6c14bc82a2b70183e708ba \
+    --hash=sha256:983b6efd649723474f29ed42e1467f90a35a74793437d0bc64a5bf482bedfa0a \
+    --hash=sha256:98da17ce9cbf3bfe4617e836d561e433f871129e3a7ac16d6ef4c680f13a839c \
+    --hash=sha256:9c236e635582742fee16603042553d276cca506e824fa2e6489db04039521e90 \
+    --hash=sha256:9da6bc32faac9a293ddfdcb9108d4b20416219461e4ec64dfea8383cac186690 \
+    --hash=sha256:a05e6d6218461eb1b4771d973728f0133b2a4613a6779995df557f70794fd60f \
+    --hash=sha256:a0817825b900fcd43ac5d05b8b3079937073d2b1ff9cf89427590718b70dd840 \
+    --hash=sha256:a4ae99c57668ca1e78597d8b06d5af837f377f340f4cce993b551b2d7731778d \
+    --hash=sha256:a8c86881813a78a6f4508ef9daf9d4995b8ac2d147dcb1a450448941398091c9 \
+    --hash=sha256:a8fffdbd9d1408006baaf02f1068d7dd1f016c6bcb7538682622c556e7b68e35 \
+    --hash=sha256:a9b07268d0c3ca5c170a385a0ab9fb7fdd9f5fd866be004c4ea39e44edce47dd \
+    --hash=sha256:ab19a2d91963ed9e42b4e8d77cd847ae8381576585bad79dbd0a8837a9f6620a \
+    --hash=sha256:ac184f87ff521f4840e6ea0b10c0ec90c6b1dcd0bad2f1e4a9a1b4fa177982ea \
+    --hash=sha256:b0e166f698c5a3e914947388c162be2583e0c638a4703fc6a543e23a88dea3c1 \
+    --hash=sha256:b2170c7e0367dde86a2647ed5b6f57394ea7f53545746104c6b09fc1f4223573 \
+    --hash=sha256:b2d8c62d08e7255f68f7a740bae85b3c9b8e5466baa9cbf7f57f1cde0ac6bc09 \
+    --hash=sha256:b4567955a6bc1b20e9c31612e615af6b53733491aeaa19a6b3b37f3b65477094 \
+    --hash=sha256:b69bb4f51daf461b15e7b3db033160937d3ff88303a7bc808c67bbc1eaf98c78 \
+    --hash=sha256:b8c0bd73aeac689beacd4e7667d48c299f61b959475cdbb91e7d3d88d27c56b9 \
+    --hash=sha256:be9b5b8659dff1f913039c2feee1aca499cfbc19e98fa12bc85e037c17ec6ca5 \
+    --hash=sha256:bf0a05b6059c0528477fba9054d09179beb63744355cab9f38059548fedd46a9 \
+    --hash=sha256:c16842b846a8d2a145223f520b7e18b57c8f476924bda92aeee3a88d11cfc391 \
+    --hash=sha256:c363b53e257246a954ebc7c488304b5592b9c53fbe74d03bc1c64dda153fb847 \
+    --hash=sha256:c7c517d74bea1a6afd39aa612fa025e6b8011982a0897768a2f7c8ab4ebb78a2 \
+    --hash=sha256:d20fd853fbb5807c8e84c136c278827b6167ded66c72ec6f9a14b863d809211c \
+    --hash=sha256:d2240ddc86b74966c34554c49d00eaafa8200a18d3a5b6ffbf7da63b11d74ee2 \
+    --hash=sha256:d477ed829077cd945b01fc3115edd132c47e6540ddcd96ca169facff28173057 \
+    --hash=sha256:d50d31bfedd53a928fed6707b15a8dbeef011bb6366297cc435accc888b27c20 \
+    --hash=sha256:dc1d33abb8a0d754ea4763bad944fd965d3d95b5baef6b121c0c9013eaf1907d \
+    --hash=sha256:dc5d1a49d3f8262be192589a4b72f0d03b72dcf46c51ad5852a4fdc67be7b9e4 \
+    --hash=sha256:e2d1a054f8f0a191004675755448d12be47fa9bebbcffa3cdf01db19f2d30a54 \
+    --hash=sha256:e7792606d606c8df5277c32ccb58f29b9b8603bf83b48639b7aedf6df4fe8171 \
+    --hash=sha256:ed1708dbf4d2e3a1c5c69110ba2b4eb6678262028afd6c6fbcc5a8dac9cda68e \
+    --hash=sha256:f2d4380bf5f62daabd7b751ea2339c1a21d1c9463f1feb7fc2bdcea2c29c3160 \
+    --hash=sha256:f3513916e8c645d0610815c257cbfd3242adfd5c4cfa78be514e5a3ebb42a41b \
+    --hash=sha256:f8346bfa098532bc1fb6c7ef06783e969d87a99dd1d2a5a18a892c1d7a643c58 \
+    --hash=sha256:f83fa6cae3fff8e98691248c9320356971b59678a17f20656a9e59cd32cee6d8 \
+    --hash=sha256:fa6ce8b52c5987b3e34d5674b0ab529a4602b632ebab0a93b07bfb4dfc8f8a33 \
+    --hash=sha256:fb2b1ecfef1e67897d336de3a0e3f52478182d6a47eda86cbd42504c5cbd009a \
+    --hash=sha256:fc9ca1c9718cb3b06634c7c8dec57d24e9438b2aa9a0f02b8bb36bf478538880 \
+    --hash=sha256:fd30d9c67d13d891f2360b2a120186729c111238ac63b43dbd37a5a40670b8ca \
+    --hash=sha256:fd7699e8fd9969f455ef2926221e0233f81a2542921471382e77a9e2f2b57f4b \
+    --hash=sha256:fe3b385d996ee0822fd46528d9f0443b880d4d05528fd26a9119a54ec3f91c69
     # via -r build/zstandard_requirements.in
diff --git a/mozjs-sys/mozjs/config/milestone.txt b/mozjs-sys/mozjs/config/milestone.txt
index 58c8720643..bc57fb6e9a 100644
--- a/mozjs-sys/mozjs/config/milestone.txt
+++ b/mozjs-sys/mozjs/config/milestone.txt
@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-128.3.0
+128.6.0
diff --git a/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.cpp b/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.cpp
index b7c82bb135..126991c51a 100644
--- a/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.cpp
+++ b/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.cpp
@@ -574,7 +574,7 @@ static void DestroyBreakIterator(const T* segments) {
   void* brk = segments->getBreakIterator();
   MOZ_ASSERT(brk);
 
-  bool isLatin1 = segments->getString()->hasLatin1Chars();
+  bool isLatin1 = segments->hasLatin1StringChars();
 
   switch (segments->getGranularity()) {
     case SegmenterGranularity::Grapheme: {
@@ -611,16 +611,16 @@ void SegmentsObject::finalize(JS::GCContext* gcx, JSObject* obj) {
   MOZ_ASSERT(gcx->onMainThread());
 
   auto* segments = &obj->as<SegmentsObject>();
-  bool isLatin1 = segments->getString()->hasLatin1Chars();
 
-  if (void* chars = segments->getStringChars()) {
+  if (auto chars = segments->getStringChars()) {
     size_t length = segments->getString()->length();
-    if (isLatin1) {
+    if (chars.has<JS::Latin1Char>()) {
       intl::RemoveICUCellMemory(gcx, segments, length * sizeof(JS::Latin1Char));
+      js_free(chars.data<JS::Latin1Char>());
     } else {
       intl::RemoveICUCellMemory(gcx, segments, length * sizeof(char16_t));
+      js_free(chars.data<char16_t>());
     }
-    js_free(chars);
   }
 
   if (segments->getBreakIterator()) {
@@ -632,16 +632,16 @@ void SegmentIteratorObject::finalize(JS::GCContext* gcx, JSObject* obj) {
   MOZ_ASSERT(gcx->onMainThread());
 
   auto* iterator = &obj->as<SegmentIteratorObject>();
-  bool isLatin1 = iterator->getString()->hasLatin1Chars();
 
-  if (void* chars = iterator->getStringChars()) {
+  if (auto chars = iterator->getStringChars()) {
     size_t length = iterator->getString()->length();
-    if (isLatin1) {
+    if (chars.has<JS::Latin1Char>()) {
       intl::RemoveICUCellMemory(gcx, iterator, length * sizeof(JS::Latin1Char));
+      js_free(chars.data<JS::Latin1Char>());
     } else {
       intl::RemoveICUCellMemory(gcx, iterator, length * sizeof(char16_t));
+      js_free(chars.data<char16_t>());
     }
-    js_free(chars);
   }
 
   if (iterator->getBreakIterator()) {
@@ -660,7 +660,7 @@ static Boundaries FindBoundaryFrom(Handle<T*> segments, int32_t index) {
 template <typename T>
 static Boundaries GraphemeBoundaries(Handle<T*> segments, int32_t index) {
 #if defined(MOZ_ICU4X)
-  if (segments->getString()->hasLatin1Chars()) {
+  if (segments->hasLatin1StringChars()) {
     return FindBoundaryFrom<GraphemeClusterSegmenter::BreakIteratorLatin1>(
         segments, index);
   }
@@ -674,7 +674,7 @@ static Boundaries GraphemeBoundaries(Handle<T*> segments, int32_t index) {
 template <typename T>
 static Boundaries WordBoundaries(Handle<T*> segments, int32_t index) {
 #if defined(MOZ_ICU4X)
-  if (segments->getString()->hasLatin1Chars()) {
+  if (segments->hasLatin1StringChars()) {
     return FindBoundaryFrom<WordSegmenter::BreakIteratorLatin1>(segments,
                                                                 index);
   }
@@ -687,7 +687,7 @@ static Boundaries WordBoundaries(Handle<T*> segments, int32_t index) {
 template <typename T>
 static Boundaries SentenceBoundaries(Handle<T*> segments, int32_t index) {
 #if defined(MOZ_ICU4X)
-  if (segments->getString()->hasLatin1Chars()) {
+  if (segments->hasLatin1StringChars()) {
     return FindBoundaryFrom<SentenceSegmenter::BreakIteratorLatin1>(segments,
                                                                     index);
   }
@@ -721,7 +721,7 @@ static bool EnsureStringChars(JSContext* cx, Handle<T*> segments) {
     if (!chars) {
       return false;
     }
-    segments->setLatin1Chars(chars.release());
+    segments->setStringChars(SegmentsStringChars{chars.release()});
 
     intl::AddICUCellMemory(segments, length * sizeof(JS::Latin1Char));
   } else {
@@ -729,7 +729,7 @@ static bool EnsureStringChars(JSContext* cx, Handle<T*> segments) {
     if (!chars) {
       return false;
     }
-    segments->setTwoByteChars(chars.release());
+    segments->setStringChars(SegmentsStringChars{chars.release()});
 
     intl::AddICUCellMemory(segments, length * sizeof(char16_t));
   }
@@ -744,7 +744,7 @@ static auto* CreateBreakIterator(Handle<T*> segments) {
   void* segmenter = segments->getSegmenter()->getSegmenter();
   MOZ_ASSERT(segmenter);
 
-  void* chars = segments->getStringChars();
+  auto chars = segments->getStringChars();
   MOZ_ASSERT(chars);
 
   size_t length = segments->getString()->length();
@@ -753,8 +753,9 @@ static auto* CreateBreakIterator(Handle<T*> segments) {
       typename Interface::Char)>::Type;
 
   auto* seg = static_cast<const typename Interface::Segmenter*>(segmenter);
-  auto* ch = static_cast<const Unsigned*>(chars);
-  return Interface::create(seg, ch, length);
+  auto* ch = chars.template data<typename Interface::Char>();
+  auto* chUnsigned = reinterpret_cast<Unsigned*>(ch);
+  return Interface::create(seg, chUnsigned, length);
 }
 
 /**
@@ -785,7 +786,7 @@ static bool EnsureBreakIterator(JSContext* cx, Handle<T*> segments,
   }
 
 #if defined(MOZ_ICU4X)
-  bool isLatin1 = segments->getString()->hasLatin1Chars();
+  bool isLatin1 = segments->hasLatin1StringChars();
 
   // Create a new break iterator based on the granularity and character type.
   void* brk;
diff --git a/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.h b/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.h
index 1567a3f774..2b75b86488 100644
--- a/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.h
+++ b/mozjs-sys/mozjs/js/src/builtin/intl/Segmenter.h
@@ -8,6 +8,7 @@
 #define builtin_intl_Segmenter_h
 
 #include <stdint.h>
+#include <type_traits>
 
 #include "builtin/SelfHostingDefines.h"
 #include "js/Class.h"
@@ -84,6 +85,66 @@ class SegmenterObject : public NativeObject {
   static void finalize(JS::GCContext* gcx, JSObject* obj);
 };
 
+class SegmentsStringChars final {
+  uintptr_t tagged_ = 0;
+
+  enum Tag {
+    Latin1 = 0,
+    TwoByte = 1,
+
+    TagMask = TwoByte,
+  };
+
+  static uintptr_t toTagged(const void* chars, Tag tag) {
+    MOZ_ASSERT(chars != nullptr, "can't tag nullptr");
+
+    auto ptr = reinterpret_cast<uintptr_t>(chars);
+    MOZ_ASSERT((ptr & TagMask) == 0, "pointer already tagged");
+
+    return ptr | tag;
+  }
+
+  Tag tag() const { return static_cast<Tag>(tagged_ & TagMask); }
+
+  uintptr_t untagged() const { return tagged_ & ~TagMask; }
+
+  explicit SegmentsStringChars(const void* taggedChars)
+      : tagged_(reinterpret_cast<uintptr_t>(taggedChars)) {}
+
+ public:
+  SegmentsStringChars() = default;
+
+  explicit SegmentsStringChars(const JS::Latin1Char* chars)
+      : tagged_(toTagged(chars, Latin1)) {}
+
+  explicit SegmentsStringChars(const char16_t* chars)
+      : tagged_(toTagged(chars, TwoByte)) {}
+
+  static auto fromTagged(const void* taggedChars) {
+    return SegmentsStringChars{taggedChars};
+  }
+
+  explicit operator bool() const { return tagged_ != 0; }
+
+  template <typename CharT>
+  bool has() const {
+    if constexpr (std::is_same_v<CharT, JS::Latin1Char>) {
+      return tag() == Latin1;
+    } else {
+      static_assert(std::is_same_v<CharT, char16_t>);
+      return tag() == TwoByte;
+    }
+  }
+
+  template <typename CharT>
+  CharT* data() const {
+    MOZ_ASSERT(has<CharT>());
+    return reinterpret_cast<CharT*>(untagged());
+  }
+
+  uintptr_t tagged() const { return tagged_; }
+};
+
 class SegmentsObject : public NativeObject {
  public:
   static const JSClass class_;
@@ -125,20 +186,21 @@ class SegmentsObject : public NativeObject {
     return !getFixedSlot(STRING_CHARS_SLOT).isUndefined();
   }
 
-  void* getStringChars() const {
+  SegmentsStringChars getStringChars() const {
     const auto& slot = getFixedSlot(STRING_CHARS_SLOT);
     if (slot.isUndefined()) {
-      return nullptr;
+      return SegmentsStringChars{};
     }
-    return slot.toPrivate();
+    return SegmentsStringChars::fromTagged(slot.toPrivate());
   }
 
-  void setLatin1Chars(JS::Latin1Char* chars) {
-    setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars));
+  void setStringChars(SegmentsStringChars chars) {
+    setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars.tagged()));
   }
 
-  void setTwoByteChars(char16_t* chars) {
-    setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars));
+  bool hasLatin1StringChars() const {
+    MOZ_ASSERT(hasStringChars());
+    return getStringChars().has<JS::Latin1Char>();
   }
 
   int32_t getIndex() const {
@@ -226,20 +288,21 @@ class SegmentIteratorObject : public NativeObject {
     return !getFixedSlot(STRING_CHARS_SLOT).isUndefined();
   }
 
-  void* getStringChars() const {
+  SegmentsStringChars getStringChars() const {
     const auto& slot = getFixedSlot(STRING_CHARS_SLOT);
     if (slot.isUndefined()) {
-      return nullptr;
+      return SegmentsStringChars{};
     }
-    return slot.toPrivate();
+    return SegmentsStringChars::fromTagged(slot.toPrivate());
   }
 
-  void setLatin1Chars(JS::Latin1Char* chars) {
-    setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars));
+  void setStringChars(SegmentsStringChars chars) {
+    setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars.tagged()));
   }
 
-  void setTwoByteChars(char16_t* chars) {
-    setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars));
+  bool hasLatin1StringChars() const {
+    MOZ_ASSERT(hasStringChars());
+    return getStringChars().has<JS::Latin1Char>();
   }
 
   int32_t getIndex() const {
diff --git a/mozjs-sys/mozjs/js/src/vm/ArrayBufferViewObject.cpp b/mozjs-sys/mozjs/js/src/vm/ArrayBufferViewObject.cpp
index eec78ef3cd..57255eb144 100644
--- a/mozjs-sys/mozjs/js/src/vm/ArrayBufferViewObject.cpp
+++ b/mozjs-sys/mozjs/js/src/vm/ArrayBufferViewObject.cpp
@@ -203,14 +203,14 @@ bool ArrayBufferViewObject::initResizable(JSContext* cx,
                                           AutoLength autoLength) {
   MOZ_ASSERT(buffer->isResizable());
 
-  if (!init(cx, buffer, byteOffset, length, bytesPerElement)) {
-    return false;
-  }
-
   initFixedSlot(AUTO_LENGTH_SLOT, BooleanValue(static_cast<bool>(autoLength)));
   initFixedSlot(INITIAL_LENGTH_SLOT, PrivateValue(length));
   initFixedSlot(INITIAL_BYTE_OFFSET_SLOT, PrivateValue(byteOffset));
 
+  if (!init(cx, buffer, byteOffset, length, bytesPerElement)) {
+    return false;
+  }
+
   // Compute the actual byteLength and byteOffset for non-shared buffers.
   if (!isSharedMemory()) {
     computeResizableLengthAndByteOffset(bytesPerElement);
diff --git a/mozjs-sys/mozjs/js/src/vm/Modules.cpp b/mozjs-sys/mozjs/js/src/vm/Modules.cpp
index e85fa3ca02..f4f717bc8f 100644
--- a/mozjs-sys/mozjs/js/src/vm/Modules.cpp
+++ b/mozjs-sys/mozjs/js/src/vm/Modules.cpp
@@ -45,9 +45,9 @@ using mozilla::Utf8Unit;
 
 static bool ModuleLink(JSContext* cx, Handle<ModuleObject*> module);
 static bool ModuleEvaluate(JSContext* cx, Handle<ModuleObject*> module,
-                           MutableHandle<Value> result);
+                           MutableHandle<Value> rval);
 static bool SyntheticModuleEvaluate(JSContext* cx, Handle<ModuleObject*> module,
-                                    MutableHandle<Value> result);
+                                    MutableHandle<Value> rval);
 
 ////////////////////////////////////////////////////////////////////////////////
 // Public API
@@ -1433,8 +1433,8 @@ static bool InnerModuleLinking(JSContext* cx, Handle<ModuleObject*> module,
 
 static bool SyntheticModuleEvaluate(JSContext* cx,
                                     Handle<ModuleObject*> moduleArg,
-                                    MutableHandle<Value> result) {
-  // Steps 1-12 happens elsewhere in the engine.
+                                    MutableHandle<Value> rval) {
+  // Steps 1-12 happen elsewhere in the engine.
 
   // Step 13. Let pc be ! NewPromiseCapability(%Promise%).
   Rooted<PromiseObject*> resultPromise(cx, CreatePromiseObjectForAsync(cx));
@@ -1442,15 +1442,18 @@ static bool SyntheticModuleEvaluate(JSContext* cx,
     return false;
   }
 
+  // Since the only synthetic modules we support are JSON modules, result is
+  // always |undefined|.
+
   // Step 14. IfAbruptRejectPromise(result, pc) (Skipped)
 
   // 15. Perform ! pc.[[Resolve]](result).
-  if (!AsyncFunctionReturned(cx, resultPromise, result)) {
+  if (!AsyncFunctionReturned(cx, resultPromise, JS::UndefinedHandleValue)) {
     return false;
   }
 
   // 16. Return pc.[[Promise]].
-  result.set(ObjectValue(*resultPromise));
+  rval.set(ObjectValue(*resultPromise));
   return true;
 }
 
diff --git a/mozjs-sys/mozjs/modules/libpref/init/StaticPrefList.yaml b/mozjs-sys/mozjs/modules/libpref/init/StaticPrefList.yaml
index 1a89a17454..1b8d713f6f 100644
--- a/mozjs-sys/mozjs/modules/libpref/init/StaticPrefList.yaml
+++ b/mozjs-sys/mozjs/modules/libpref/init/StaticPrefList.yaml
@@ -3165,13 +3165,13 @@
 
 # Limit of location change caused by content scripts in a time span per
 # BrowsingContext. This includes calls to History and Location APIs.
-- name: dom.navigation.locationChangeRateLimit.count
+- name: dom.navigation.navigationRateLimit.count
   type: uint32_t
   value: 200
   mirror: always
 
 # Time span in seconds for location change rate limit.
-- name: dom.navigation.locationChangeRateLimit.timespan
+- name: dom.navigation.navigationRateLimit.timespan
   type: uint32_t
   value: 10
   mirror: always
@@ -5648,6 +5648,13 @@
   mirror: always
 #endif
 
+# If true, open system preferences for the user when geolocation is requested
+# by the user but OS geolocation permission is not available.
+- name: geo.prompt.open_system_prefs
+  type: bool
+  value: true
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "gfx."
 #---------------------------------------------------------------------------
@@ -12066,6 +12073,34 @@
   value: true
   mirror: never
 
+# Whether or not we use MS Entra SSO to network.microsoft-sso-authority-list sites.
+- name: network.http.microsoft-entra-sso.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
+# Whether microsoft-entra-sso is enabled for the default (0) container.
+# To enable SSO for additional containers, add a new pref like
+# `network.http.microsoft-entra-sso.container-enabled.${containerId}` = true
+- name: network.http.microsoft-entra-sso.container-enabled.0
+  type: bool
+  value: true
+  mirror: never
+
+# To specify the list of trusted Microsoft Single Sign-On (SSO) authority URLs
+# This is needed for macOS unlike Windows where we send every URL to SSO
+- name: network.microsoft-sso-authority-list
+  type: String
+  value: >-
+    login.microsoft.com,
+    login.microsoftonline.com,
+    sts.windows.net,
+    login.partner.microsoftonline.cn,
+    login.chinacloudapi.cn,
+    login.microsoftonline.us,
+    login-us.microsoftonline.com
+  mirror: never
+
 # The factor by which to increase the keepalive timeout when the
 # NS_HTTP_LARGE_KEEPALIVE flag is used for a connection
 - name: network.http.largeKeepaliveFactor
@@ -12946,12 +12981,17 @@
 
 # When the TRR confirmation is set to CONFIRM_FAILED due to many failures in
 # a row, we set a timer to retry. This has an exponential backoff up to
-# 64 seconds.
+# network.trr.max-retry-timeout-ms (64 seconds by default)
 - name: network.trr.retry-timeout-ms
   type: RelaxedAtomicUint32
   value: 125
   mirror: always
 
+- name: network.trr.max-retry-timeout-ms
+  type: RelaxedAtomicUint32
+  value: 64000
+  mirror: always
+
 # Retry with no TRR when the response contained only 0.0.0.0 or ::
 - name: network.trr.fallback-on-zero-response
   type: RelaxedAtomicBool
@@ -13153,7 +13193,30 @@
 
 - name: network.http.http2.enabled.deps
   type: RelaxedAtomicBool
-  value: true
+  value: false
+  mirror: always
+
+# When true, Firefox will send Extensivle prioritization scheme
+# PRIORITY_UPDATE frames.
+- name: network.http.http2.priority_updates
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
+# This pref controls whether to send the
+# SETTINGS_NO_RFC7540_PRIORITIES when stream dependencies
+# are disabled, and extensible prioritization scheme is in use.
+# defaults to false as some servers panic when they see this (bug 1928600)
+- name: network.http.http2.send_NO_RFC7540_PRI
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
+# This pref controls whether to send PRIORITY_UPDATE
+# frames for pushed streams.
+- name: network.http.http2.push_priority_update
+  type: RelaxedAtomicBool
+  value: false
   mirror: always
 
 - name: network.http.http2.enforce-tls-profile
@@ -13203,7 +13266,15 @@
 
 - name: network.http.http2.allow-push
   type: RelaxedAtomicBool
-  value: true
+  value: false
+  mirror: always
+
+# When true, Firefox will send a SETTINGS_MAX_CONCURRENT_STREAMS
+# parameter when push is disabled. Chrome doesn't send this,
+# so some servers misbehave when we do. See Bug 1919750.
+- name: network.http.http2.send-push-max-concurrent-frame
+  type: RelaxedAtomicBool
+  value: false
   mirror: always
 
 - name: network.http.http2.push-allowance
diff --git a/mozjs-sys/mozjs/python/mach/mach/site.py b/mozjs-sys/mozjs/python/mach/mach/site.py
index 7041437bf8..c48d282b2f 100644
--- a/mozjs-sys/mozjs/python/mach/mach/site.py
+++ b/mozjs-sys/mozjs/python/mach/mach/site.py
@@ -17,6 +17,7 @@
 import sys
 import sysconfig
 import tempfile
+import warnings
 from contextlib import contextmanager
 from pathlib import Path
 from typing import Callable, Optional
@@ -817,33 +818,75 @@ class PythonVirtualenv:
     """Calculates paths of interest for general python virtual environments"""
 
     def __init__(self, prefix):
-        if _is_windows:
-            self.bin_path = os.path.join(prefix, "Scripts")
-            self.python_path = os.path.join(self.bin_path, "python.exe")
-        else:
-            self.bin_path = os.path.join(prefix, "bin")
-            self.python_path = os.path.join(self.bin_path, "python")
         self.prefix = os.path.realpath(prefix)
+        self.paths = self._get_sysconfig_paths(self.prefix)
 
-    @functools.lru_cache(maxsize=None)
-    def resolve_sysconfig_packages_path(self, sysconfig_path):
-        # macOS uses a different default sysconfig scheme based on whether it's using the
-        # system Python or running in a virtualenv.
-        # Manually define the scheme (following the implementation in
-        # "sysconfig._get_default_scheme()") so that we're always following the
-        # code path for a virtualenv directory structure.
-        if os.name == "posix":
-            scheme = "posix_prefix"
-        else:
-            scheme = os.name
+        # Name of the Python executable to use in virtual environments.
+        # An executable with the same name as sys.executable might not exist in
+        # virtual environments. An executable with 'python' as the steam —
+        # without version numbers or ABI flags — will always be present in
+        # virtual environments, so we use that.
+        python_exe_name = "python" + sysconfig.get_config_var("EXE")
+
+        self.bin_path = self.paths["scripts"]
+        self.python_path = os.path.join(self.bin_path, python_exe_name)
 
-        sysconfig_paths = sysconfig.get_paths(scheme)
-        data_path = Path(sysconfig_paths["data"])
-        path = Path(sysconfig_paths[sysconfig_path])
-        relative_path = path.relative_to(data_path)
+    @staticmethod
+    def _get_sysconfig_paths(prefix):
+        """Calculate the sysconfig paths of a virtual environment in the given prefix.
 
-        # Path to virtualenv's "site-packages" directory for provided sysconfig path
-        return os.path.normpath(os.path.normcase(Path(self.prefix) / relative_path))
+        The virtual environment MUST be using the same Python distribution as us.
+        """
+        # Determine the sysconfig scheme used in virtual environments
+        if "venv" in sysconfig.get_scheme_names():
+            # A 'venv' scheme was added in Python 3.11 to allow users to
+            # calculate the paths for a virtual environment, since the default
+            # scheme may not always be the same as used on virtual environments.
+            # Some common examples are the system Python distributed by macOS,
+            # Debian, and Fedora.
+            # For more information, see https://github.com/python/cpython/issues/89576
+            venv_scheme = "venv"
+        elif os.name == "nt":
+            # We know that before the 'venv' scheme was added, on Windows,
+            # the 'nt' scheme was used in virtual environments.
+            venv_scheme = "nt"
+        elif os.name == "posix":
+            # We know that before the 'venv' scheme was added, on POSIX,
+            # the 'posix_prefix' scheme was used in virtual environments.
+            venv_scheme = "posix_prefix"
+        else:
+            # This should never happen with upstream Python, as the 'venv'
+            # scheme should always be available on >=3.11, and no other
+            # platforms are supported by the upstream on older Python versions.
+            #
+            # Since the 'venv' scheme isn't available, and we have no knowledge
+            # of this platform/distribution, fallback to the default scheme.
+            #
+            # Hitting this will likely be the result of running a custom Python
+            # distribution targetting a platform that is not supported by the
+            # upstream.
+            # In this case, unless the Python vendor patched the Python
+            # distribution in such a way as the default scheme may not always be
+            # the same scheme, using the default scheme should be correct.
+            # If the vendor did patch Python as such, to work around this issue,
+            # I would recommend them to define a 'venv' scheme that matches
+            # the layout used on virtual environments in their Python distribution.
+            # (rec. signed Filipe Laíns — upstream sysconfig maintainer)
+            venv_scheme = sysconfig.get_default_scheme()
+            warnings.warn(
+                f"Unknown platform '{os.name}', using the default install scheme '{venv_scheme}'. "
+                "If this is incorrect, please ask your Python vendor to add a 'venv' sysconfig scheme "
+                "(see https://github.com/python/cpython/issues/89576, or check the code comment).",
+                stacklevel=2,
+            )
+        # Build the sysconfig config_vars dictionary for the virtual environment.
+        venv_vars = sysconfig.get_config_vars().copy()
+        venv_vars["base"] = venv_vars["platbase"] = prefix
+        # Get sysconfig paths for the virtual environment.
+        return sysconfig.get_paths(venv_scheme, vars=venv_vars)
+
+    def resolve_sysconfig_packages_path(self, sysconfig_path):
+        return self.paths[sysconfig_path]
 
     def site_packages_dirs(self):
         dirs = []
diff --git a/mozjs-sys/mozjs/python/mozboot/mozboot/base.py b/mozjs-sys/mozjs/python/mozboot/mozboot/base.py
index 23f9f7cf67..81f9b52c60 100644
--- a/mozjs-sys/mozjs/python/mozboot/mozboot/base.py
+++ b/mozjs-sys/mozjs/python/mozboot/mozboot/base.py
@@ -16,7 +16,6 @@
 from mozboot import rust
 from mozboot.util import (
     MINIMUM_RUST_VERSION,
-    get_mach_virtualenv_binary,
     http_download_and_save,
 )
 
@@ -332,46 +331,9 @@ def ensure_sccache_packages(self):
         """
         pass
 
-    def install_toolchain_artifact(self, toolchain_job, no_unpack=False):
-        if no_unpack:
-            return self.install_toolchain_artifact_impl(
-                self.state_dir, toolchain_job, no_unpack
-            )
+    def install_toolchain_artifact(self, toolchain_job):
         bootstrap_toolchain(toolchain_job)
 
-    def install_toolchain_artifact_impl(
-        self, install_dir: Path, toolchain_job, no_unpack=False
-    ):
-        if type(self.srcdir) is str:
-            mach_binary = Path(self.srcdir) / "mach"
-        else:
-            mach_binary = (self.srcdir / "mach").resolve()
-        if not mach_binary.exists():
-            raise ValueError(f"mach not found at {mach_binary}")
-
-        if not self.state_dir:
-            raise ValueError(
-                "Need a state directory (e.g. ~/.mozbuild) to download " "artifacts"
-            )
-        python_location = get_mach_virtualenv_binary()
-        if not python_location.exists():
-            raise ValueError(f"python not found at {python_location}")
-
-        cmd = [
-            str(python_location),
-            str(mach_binary),
-            "artifact",
-            "toolchain",
-            "--bootstrap",
-            "--from-build",
-            toolchain_job,
-        ]
-
-        if no_unpack:
-            cmd += ["--no-unpack"]
-
-        subprocess.check_call(cmd, cwd=str(install_dir))
-
     def auto_bootstrap(self, application, exclude=[]):
         args = ["--with-ccache=sccache"]
         if application.endswith("_artifact_mode"):
diff --git a/mozjs-sys/mozjs/python/mozboot/mozboot/mozillabuild.py b/mozjs-sys/mozjs/python/mozboot/mozboot/mozillabuild.py
index 55a3cca1f5..a1ecec92e2 100644
--- a/mozjs-sys/mozjs/python/mozboot/mozboot/mozillabuild.py
+++ b/mozjs-sys/mozjs/python/mozboot/mozboot/mozillabuild.py
@@ -217,8 +217,8 @@ def generate_mobile_android_artifact_mode_mozconfig(self):
     def ensure_sccache_packages(self):
         from mozboot import sccache
 
-        self.install_toolchain_artifact(sccache.RUSTC_DIST_TOOLCHAIN, no_unpack=True)
-        self.install_toolchain_artifact(sccache.CLANG_DIST_TOOLCHAIN, no_unpack=True)
+        self.install_toolchain_artifact(sccache.RUSTC_DIST_TOOLCHAIN)
+        self.install_toolchain_artifact(sccache.CLANG_DIST_TOOLCHAIN)
 
     def _update_package_manager(self):
         pass
diff --git a/mozjs-sys/mozjs/python/mozboot/mozboot/osx.py b/mozjs-sys/mozjs/python/mozboot/mozboot/osx.py
index 8cd180f4ab..078d2abb06 100644
--- a/mozjs-sys/mozjs/python/mozboot/mozboot/osx.py
+++ b/mozjs-sys/mozjs/python/mozboot/mozboot/osx.py
@@ -269,8 +269,8 @@ def ensure_homebrew_installed(self):
     def ensure_sccache_packages(self):
         from mozboot import sccache
 
-        self.install_toolchain_artifact(sccache.RUSTC_DIST_TOOLCHAIN, no_unpack=True)
-        self.install_toolchain_artifact(sccache.CLANG_DIST_TOOLCHAIN, no_unpack=True)
+        self.install_toolchain_artifact(sccache.RUSTC_DIST_TOOLCHAIN)
+        self.install_toolchain_artifact(sccache.CLANG_DIST_TOOLCHAIN)
 
     def install_homebrew(self):
         print(BREW_INSTALL)
diff --git a/mozjs-sys/mozjs/python/mozboot/mozboot/util.py b/mozjs-sys/mozjs/python/mozboot/mozboot/util.py
index d523319d8b..0093fee3c5 100644
--- a/mozjs-sys/mozjs/python/mozboot/mozboot/util.py
+++ b/mozjs-sys/mozjs/python/mozboot/mozboot/util.py
@@ -4,6 +4,7 @@
 
 import hashlib
 import os
+import ssl
 from pathlib import Path
 from urllib.request import urlopen
 
@@ -34,7 +35,8 @@ def http_download_and_save(url, dest: Path, hexhash, digest="sha256"):
     that will be used to validate the downloaded file using the given
     digest algorithm.  The value of digest can be any value accepted by
     hashlib.new.  The default digest used is 'sha256'."""
-    f = urlopen(url, cafile=certifi.where())
+    ssl_context = ssl.create_default_context(cafile=certifi.where())
+    f = urlopen(url, context=ssl_context)
     h = hashlib.new(digest)
     with open(dest, "wb") as out:
         while True:
diff --git a/mozjs-sys/mozjs/python/mozbuild/mozbuild/action/node.py b/mozjs-sys/mozjs/python/mozbuild/mozbuild/action/node.py
index fca0745b80..9f90a220bc 100644
--- a/mozjs-sys/mozjs/python/mozbuild/mozbuild/action/node.py
+++ b/mozjs-sys/mozjs/python/mozbuild/mozbuild/action/node.py
@@ -2,13 +2,14 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-import pipes
 import subprocess
 import sys
 
 import buildconfig
 import six
 
+from mozbuild.shellutil import quote as shell_quote
+
 SCRIPT_ALLOWLIST = [buildconfig.topsrcdir + "/devtools/client/shared/build/build.js"]
 
 ALLOWLIST_ERROR = """
@@ -47,8 +48,7 @@ def execute_node_cmd(node_cmd_list):
     """
 
     try:
-        printable_cmd = " ".join(pipes.quote(arg) for arg in node_cmd_list)
-        print('Executing "{}"'.format(printable_cmd), file=sys.stderr)
+        print('Executing "{}"'.format(shell_quote(*node_cmd_list)), file=sys.stderr)
         sys.stderr.flush()
 
         # We need to redirect stderr to a pipe because
diff --git a/mozjs-sys/mozjs/python/mozbuild/mozbuild/artifact_commands.py b/mozjs-sys/mozjs/python/mozbuild/mozbuild/artifact_commands.py
index e42b5a38d9..5fe8a472d5 100644
--- a/mozjs-sys/mozjs/python/mozbuild/mozbuild/artifact_commands.py
+++ b/mozjs-sys/mozjs/python/mozbuild/mozbuild/artifact_commands.py
@@ -480,6 +480,7 @@ def __init__(self, task_id, artifact_name):
             )
 
             record = ArtifactRecord(task_id, artifact_name)
+            record.unpack = task.attributes.get("toolchain-extract", True)
             records[record.filename] = record
 
     # Handle the list of files of the form task_id:path from --from-task.
diff --git a/mozjs-sys/mozjs/python/mozbuild/mozbuild/test/configure/test_bootstrap.py b/mozjs-sys/mozjs/python/mozbuild/mozbuild/test/configure/test_bootstrap.py
index e3e3d3c744..a140070102 100644
--- a/mozjs-sys/mozjs/python/mozbuild/mozbuild/test/configure/test_bootstrap.py
+++ b/mozjs-sys/mozjs/python/mozbuild/mozbuild/test/configure/test_bootstrap.py
@@ -79,14 +79,17 @@ def mock_mach(input, args, cwd):
                 "toolchain-foo": {
                     "index": ["fake.index.foo"],
                     "artifact": "public/foo.artifact",
+                    "extract": True,
                 },
                 "toolchain-linux64-bar": {
                     "index": ["fake.index.bar"],
                     "artifact": "public/bar.artifact",
+                    "extract": True,
                 },
                 "toolchain-linux64-qux": {
                     "index": ["fake.index.qux"],
                     "artifact": "public/qux.artifact",
+                    "extract": True,
                 },
             },
         )
diff --git a/mozjs-sys/mozjs/python/mozversioncontrol/mozversioncontrol/__init__.py b/mozjs-sys/mozjs/python/mozversioncontrol/mozversioncontrol/__init__.py
index 7c0703bb3f..ad98a27839 100644
--- a/mozjs-sys/mozjs/python/mozversioncontrol/mozversioncontrol/__init__.py
+++ b/mozjs-sys/mozjs/python/mozversioncontrol/mozversioncontrol/__init__.py
@@ -1019,9 +1019,10 @@ def get_files(self, path):
         """
         res = []
         # move away the .git or .hg folder from path to more easily test in a hg/git repo
-        for root, dirs, files in os.walk("."):
+        for root, dirs, files in os.walk(self.path):
+            base = os.path.relpath(root, self.path)
             for name in files:
-                res.append(os.path.join(root, name))
+                res.append(os.path.join(base, name))
         return res
 
     def get_tracked_files_finder(self, path):
diff --git a/mozjs-sys/mozjs/python/sites/mach.txt b/mozjs-sys/mozjs/python/sites/mach.txt
index f1876ed53e..eb2ac069b2 100644
--- a/mozjs-sys/mozjs/python/sites/mach.txt
+++ b/mozjs-sys/mozjs/python/sites/mach.txt
@@ -101,4 +101,4 @@ pypi-optional:glean-sdk==60.1.1:telemetry will not be collected
 # We aren't (yet) able to pin packages in automation, so we have to
 # support down to the oldest locally-installed version (5.4.2).
 pypi-optional:psutil>=5.4.2,<=5.9.4:telemetry will be missing some data
-pypi-optional:zstandard>=0.11.1,<=0.22.0:zstd archives will not be possible to extract
+pypi-optional:zstandard>=0.11.1,<=0.23.0:zstd archives will not be possible to extract
diff --git a/mozjs-sys/mozjs/python/sites/python-test.txt b/mozjs-sys/mozjs/python/sites/python-test.txt
index 58ad4f5efb..90178ec378 100644
--- a/mozjs-sys/mozjs/python/sites/python-test.txt
+++ b/mozjs-sys/mozjs/python/sites/python-test.txt
@@ -5,7 +5,7 @@ pypi:Flask==2.1.3
 pypi:MarkupSafe==2.0.1
 # (indirect) avoids dependency on markupsafe >= 2.1.0, which is currently incompatible with glean-parser
 pypi:werkzeug==2.1.2
-pypi:zstandard==0.22.0
+pypi:zstandard==0.23.0
 vendored:testing/web-platform/tests/tools/third_party/h2/src
 vendored:testing/web-platform/tests/tools/third_party/hpack/src
 vendored:testing/web-platform/tests/tools/third_party/html5lib