[pull] main from mdn:main

.vscode/dictionaries/terms-abbreviations.txt

@@ -682,6 +682,7 @@ stringifiers
 stringifying
 stringly
 strobing
+stylability
 styracosaurus
 subarticle
 subarticles

files/en-us/glossary/browser/index.md

@@ -20,7 +20,7 @@ Common browsers include:
 - [Web browser](https://en.wikipedia.org/wiki/Web_browser) on Wikipedia
 - {{HTTPHeader("User-agent")}} HTTP request header
 - Browser download links:
-  - [Apple Safari](https://support.apple.com/downloads/safari)
+  - [Apple Safari](https://www.apple.com/safari/) (Safari is not a downloadable browser)
   - [Google Chrome](https://www.google.com/chrome/)
   - [Microsoft Edge](https://www.microsoft.com/en-us/edge)
   - [Mozilla Firefox](https://www.firefox.com/en-US/)

files/en-us/glossary/google_chrome/index.md

@@ -35,7 +35,7 @@ If you want to try the latest Chrome features, install one of the pre-stable bui
 - [The Chromium Projects](https://www.chromium.org/)
 - [Chrome for Developers](https://developer.chrome.com/)
 - [Chrome Platform Status](https://chromestatus.com/)
-- [Report Chromium issues](https://bugs.chromium.org/p/chromium/issues/list)
+- [Report Chromium issues](https://issues.chromium.org/issues)
 - Related glossary terms:
   - {{glossary("Browser")}}
   - {{glossary("Blink")}}

files/en-us/glossary/microsoft_edge/index.md

@@ -21,4 +21,4 @@ Edge used EdgeHTML as its {{Glossary("Engine/Rendering", "rendering engine")}} u
   - {{Glossary("Blink")}}
   - {{Glossary("Trident")}}
   - {{Glossary("WebKit")}}
-  - Other browsers: {{glossary("Google Chrome")}}, {{glossary("Microsoft Edge")}}, {{glossary("Mozilla Firefox")}}, {{glossary("Opera Browser")}}
+  - Other browsers: {{glossary("Apple Safari")}}, {{glossary("Google Chrome")}}, {{glossary("Mozilla Firefox")}}, {{glossary("Opera Browser")}}

files/en-us/glossary/mozilla_firefox/index.md

@@ -33,7 +33,7 @@ If you want to try the latest Firefox features, install one of the pre-release b
 ## See also
 
 - [Firefox](https://en.wikipedia.org/wiki/Firefox) on Wikipedia
-- [Firefox Release Notes](https://www.mozilla.org/en-US/firefox/releases/)
+- [Firefox Release Notes](https://www.firefox.com/en-US/releases/)
 - [Firefox Source Docs](https://firefox-source-docs.mozilla.org/)
 - [Firefox developer documentation](/en-US/docs/Mozilla/Firefox) on MDN Web Docs
 - [SpiderMonkey](https://spidermonkey.dev/) JavaScript and WebAssembly engine

files/en-us/glossary/opera_browser/index.md

@@ -13,7 +13,7 @@ Opera is available for multiple platforms:
 
 - [Opera for Windows, macOS, and Linux](https://www.opera.com/download)
 - [Opera for Android](https://play.google.com/store/apps/details?id=com.opera.browser)
-- [Opera for iOS](https://apps.apple.com/app/opera-browser-fast-private/id1411869974)
+- [Opera for iOS](https://apps.apple.com/us/app/opera-ai-browser-with-vpn/id1411869974)
 
 ## See also
 

files/en-us/mdn/writing_guidelines/page_structures/page_types/api_property_subpage_template/index.md

@@ -98,7 +98,7 @@ _If you need more than a couple of paragraphs, this should be added in a "Descri
 A \{{domxref("SomeDataType" }}.
 
 _Normally just the data type, and allowed values for that data type if relevant._
-_If the property has different setter and getter behaviour, these should normally be covered in separate sentences._
+_If the property has different setter and getter behavior, these should normally be covered in separate sentences._
 
 _In some cases you may want to say more about what the data type represents._
 _This is acceptable, but should not duplicate information from the "Description" section (you should include information about what the value means there)._

files/en-us/mozilla/firefox/releases/111/index.md

@@ -52,7 +52,7 @@ No notable changes.
 
 #### Media, WebRTC, and Web Audio
 
-- [`RTCInboundRtpStreamStats.trackIdentifier`](/en-US/docs/Web/API/RTCInboundRtpStreamStats#trackidentifier) is now supported.
+- [`RTCInboundRtpStreamStats.trackIdentifier`](/en-US/docs/Web/API/RTCInboundRtpStreamStats/trackIdentifier) is now supported.
   This allows developers to associate `inbound-rtp` statistics with a particular track when using {{domxref("RTCPeerConnection.getStats()")}}.
   (For more information see [Firefox bug 1804676](https://bugzil.la/1804676).)
 

files/en-us/mozilla/firefox/releases/141/index.md

@@ -52,7 +52,7 @@ Firefox 141 was released on [July 22, 2025](https://whattrainisitnow.com/release
 
 #### General
 
-- Removed the experimental CDP (Chrome DevTools Protocol) implementation from Firefox. With it we also removed the support for the `remote.active-protocols` preference. More details on this topic can be found on [fxdx.dev](https://fxdx.dev/cdp-retirement-in-firefox/) ([Firefox bug 1882096](https://bugzil.la/1882096)).
+- Removed the experimental CDP (Chrome DevTools Protocol) implementation from Firefox. With it we also removed the support for the `remote.active-protocols` preference. More details on this topic can be found on [Firefox Developer Experience](https://fxdx.dev/cdp-retirement-in-firefox/) ([Firefox bug 1882096](https://bugzil.la/1882096)).
 - Removed the temporary `remote.system-access-check.enabled` preference. This preference can no longer be used to disable system access checks when using WebDriver in Firefox's chrome scope during testing ([Firefox bug 1955007](https://bugzil.la/1955007)).
 
 #### WebDriver BiDi

files/en-us/mozilla/firefox/releases/142/index.md

@@ -117,7 +117,6 @@ Firefox 142 is the current [Beta version of Firefox](https://www.firefox.com/en-
 
   The CSS {{CSSXRef(":heading")}} pseudo-class allows you to style all [heading elements](/en-US/docs/Web/HTML/Reference/Elements/Heading_Elements) (`<h1>`-`<h6>`) at once rather than targeting them individually. The {{CSSXRef(":heading_function", ":heading()")}} functional pseudo-class allows you to style heading elements that match the [`<An+B>`](/en-US/docs/Web/CSS/:heading_function#functional_notation) notation. ([Firefox bug 1974386](https://bugzil.la/1974386)).
 
-
 - **`view-transition-name: match-element`** (Nightly): `layout.css.anchor-positioning.enabled`
 
   The {{CSSXRef("view-transition-name", "match-element", "#match-element")}} value of the CSS {{CSSXRef("view-transition-name")}} property [automatically](/en-US/docs/Web/CSS/view-transition-name#specifying_view-transition-name_values_automatically) assigns a unique internal `view-transition-name` to each selected element, rather than having to name them individually. ([Firefox bug 1956141](https://bugzil.la/1956141)).

files/en-us/web/api/rtcinboundrtpstreamstats/index.md

@@ -140,12 +140,12 @@ Their primary purpose is to examine the error resiliency of the connection, as t
 These statistics are measured at the receiving end of an RTP stream, regardless of whether it's local or remote.
 
 - {{domxref("RTCInboundRtpStreamStats.packetsReceived", "packetsReceived")}}
-  - : The total number of RTP packets received for this [synchronizing source (SSRC)](#ssrc), including retransmissions.
+  - : The total number of RTP packets received for this [synchronizing source (SSRC)](/en-US/docs/Web/API/RTCInboundRtpStreamStats/ssrc), including retransmissions.
 - {{domxref("RTCInboundRtpStreamStats.packetsLost", "packetsLost")}}
-  - : The total number of RTP packets lost for this [synchronizing source (SSRC)](#ssrc).
+  - : The total number of RTP packets lost for this [synchronizing source (SSRC)](/en-US/docs/Web/API/RTCInboundRtpStreamStats/ssrc).
     Note that this can be negative, as more packets may be received than the receiver expects.
 - {{domxref("RTCInboundRtpStreamStats.jitter", "jitter")}}
-  - : Packet jitter for this [synchronizing source (SSRC)](#ssrc), measured in seconds.
+  - : Packet jitter for this [synchronizing source (SSRC)](/en-US/docs/Web/API/RTCInboundRtpStreamStats/ssrc), measured in seconds.
 
 ### Common RTP stream statistics
 

files/en-us/web/api/rtcinboundrtpstreamstats/jitterbufferdelay/index.md

@@ -38,5 +38,5 @@ A positive number, in seconds.
 ## See also
 
 - {{domxref("RTCInboundRtpStreamStats.jitterBufferEmittedCount", "jitterBufferEmittedCount")}}
-- {{domxref("RTCInboundRtpStreamStats.jitterBufferDelay", "jitterBufferMinimumDelay")}}
+- {{domxref("RTCInboundRtpStreamStats.jitterBufferMinimumDelay", "jitterBufferMinimumDelay")}}
 - {{domxref("RTCInboundRtpStreamStats.jitterBufferTargetDelay", "jitterBufferTargetDelay")}}

files/en-us/web/api/rtcinboundrtpstreamstats/jitterbuffertargetdelay/index.md

@@ -16,7 +16,7 @@ The estimate is affected by network variability and latency as well as mechanism
 The property is updated when {{domxref("RTCInboundRtpStreamStats.jitterBufferEmittedCount", "jitterBufferEmittedCount")}} is updated.
 The average target jitter buffer delay is `jitterBufferTargetDelay / jitterBufferEmittedCount`.
 
-The property can be compared to the average of the {{domxref("RTCInboundRtpStreamStats.jitterBufferTargetDelay", "jitterBufferMinimumDelay")}} to determine the effects of external factors on the target, such as the configured `jitterBufferTarget` hint.
+The property can be compared to the average of the {{domxref("RTCInboundRtpStreamStats.jitterBufferMinimumDelay", "jitterBufferMinimumDelay")}} to determine the effects of external factors on the target, such as the configured `jitterBufferTarget` hint.
 
 ## Value
 
@@ -33,5 +33,5 @@ A positive number, in seconds.
 ## See also
 
 - {{domxref("RTCInboundRtpStreamStats.jitterBufferEmittedCount", "jitterBufferEmittedCount")}}
-- {{domxref("RTCInboundRtpStreamStats.jitterBufferTargetDelay", "jitterBufferMinimumDelay")}}
+- {{domxref("RTCInboundRtpStreamStats.jitterBufferMinimumDelay", "jitterBufferMinimumDelay")}}
 - {{domxref("RTCInboundRtpStreamStats.jitterBufferDelay", "jitterBufferDelay")}}

files/en-us/web/api/rtcinboundrtpstreamstats/packetslost/index.md

@@ -32,5 +32,4 @@ For more information see the "cumulative number of packets lost" section in {{RF
 
 - {{domxref("RTCInboundRtpStreamStats.ssrc")}}
 - {{domxref("RTCRemoteInboundRtpStreamStats.packetsLost")}}
-- {{domxref("RTCInboundRtpStreamStats.packetsLost", "packetsLost")}}
-- {{domxref("RTCInboundRtpStreamStats.packetsLost", "packetsDiscarded")}}
+- {{domxref("RTCInboundRtpStreamStats.packetsDiscarded", "packetsDiscarded")}}

files/en-us/web/api/rtcinboundrtpstreamstats/totalinterframedelay/index.md

@@ -11,7 +11,7 @@ browser-compat: api.RTCStatsReport.type_inbound-rtp.totalInterFrameDelay
 The **`totalInterFrameDelay`** property of the {{domxref("RTCInboundRtpStreamStats")}} dictionary indicates the total accumulated time between consecutively rendered frames, in seconds.
 It is recorded after each frame is rendered.
 
-The interframe delay variance can be calculated from `totalInterFrameDelay`, {{domxref("RTCInboundRtpStreamStats.totalSquaredInterFrameDelay","totalSquaredInterFrameDelay")}} , and {{domxref("RTCInboundRtpStreamStats.framesRendered","framesRendered")}} according to the formula: `(totalSquaredInterFrameDelay - totalInterFrameDelay^2/ framesRendered)/framesRendered`.
+The inter-frame delay variance can be calculated from `totalInterFrameDelay`, {{domxref("RTCInboundRtpStreamStats.totalSquaredInterFrameDelay","totalSquaredInterFrameDelay")}} , and {{domxref("RTCInboundRtpStreamStats.framesRendered","framesRendered")}} according to the formula: `(totalSquaredInterFrameDelay - totalInterFrameDelay^2/ framesRendered)/framesRendered`.
 
 > [!NOTE]
 > The property is undefined for audio streams.

files/en-us/web/api/webrtc_api/protocols/index.md

@@ -74,7 +74,7 @@ The SFM relies on the ability to determine frame dependency relationships, such
 VP8 and VP9 codecs can include frame dependency information in the VP8 payload descriptor and VP9 payload descriptor, respectively.
 For the AV1 codec the information is sent in the [Dependency Descriptor (DD) RTP Header Extension](#dependency_descriptor_rtp_header_extension).
 
-Recent browser implementations commonly use the DD header for all codecs, as it is codec-agnostic, which can simply the SFM implementation.
+Recent browser implementations commonly use the DD header for all codecs, as it is codec-agnostic, which can simplify the SFM implementation.
 In addition, because it is a part of the RTP header rather than the payload, it can be used in end-to-end encryption scenarios.
 
 ### Scalable video coding

files/en-us/web/api/websocketstream/close/index.md

@@ -51,7 +51,7 @@ const wss = new WebSocketStream(wsURL);
 
 setTimeout(() => {
   wss.close({
-    code: 1000,
+    closeCode: 1000,
     reason: "That's all folks",
   });
 }, 10000);

files/en-us/web/css/_colon_heading/index.md

@@ -37,6 +37,7 @@ The document in this example contains headings at three different levels.
   color: tomato;
 }
 ```
+
 The `:heading` pseudo-class applies the `color` to all the headings in the document:
 
 {{EmbedLiveSample("styling_all_headings", "", "170")}}

files/en-us/web/css/_colon_heading_function/index.md

@@ -103,8 +103,10 @@ main {
 :heading(n + 5) {
   color: slateblue;
 }
+```
 
 In this example:
+
 - `:heading(3, 4)` matches the `<h3>` and `<h4>` elements
 - `:heading(-n + 3)` matches heading elements in reverse, so `<h3>`, `<h2>`, and `<h1>`
 - `:heading(3n + 1)` matches every third (`3n`) heading element starting from `<h1>`, so this would include `<h1>` and `<h4>`

files/en-us/web/css/css_values_and_units/css_data_types/index.md

@@ -90,7 +90,7 @@ Some CSS properties can take a dimension or a percentage value. In this case the
 
 ## Color
 
-The [CSS color](/en-US/docs/Web/CSS/CSS_color) module defines the {{cssxref("<color>")}} data type, and other types which relate to color in CSS.
+The [CSS color](/en-US/docs/Web/CSS/CSS_colors) module defines the {{cssxref("<color>")}} data type, and other types which relate to color in CSS.
 
 - {{cssxref("<color>")}}
   - : Specified as a keyword or a numerical color value.

files/en-us/web/http/reference/headers/cross-origin-embedder-policy/index.md

@@ -10,7 +10,7 @@ sidebar: http
 The HTTP **`Cross-Origin-Embedder-Policy`** (COEP) {{Glossary("response header")}} configures the current document's policy for loading and embedding cross-origin resources.
 
 The policy for whether a particular resource is embeddable cross-site may be defined for that resource using the {{HTTPHeader("Cross-Origin-Resource-Policy")}} (CORP) header for a `no-cors` fetch, or using [CORS](/en-US/docs/Web/HTTP/Guides/CORS).
-If neither of these policies are set, then by default, resources can be loaded or embedded into a document as though they had a CORP value of `cross-site`.
+If neither of these policies are set, then by default, resources can be loaded or embedded into a document as though they had a CORP value of `cross-origin`.
 
 The **`Cross-Origin-Embedder-Policy`** allows you to require that CORP or CORS headers be set in order to load cross-site resources into the current document.
 You can also set the policy to keep the default behavior, or to allow the resources to be loaded, but strip any credentials that might otherwise be sent.

files/en-us/web/http/reference/headers/integrity-policy-report-only/index.md

@@ -42,22 +42,17 @@ Integrity-Policy-Report-Only: blocked-destinations=(<destination>),sources=(<sou
 The header values are defined as structured field dictionaries with the following keys:
 
 - `blocked-destinations`
-
   - : A list of [request destinations](/en-US/docs/Web/API/Request/destination) that must include valid integrity metadata.
     Allowed values are:
-
     - `script`
       - : Script resources.
     - `style`
       - : Stylesheet resources.
 
 - `sources` {{optional_inline}}
-
   - : A list of integrity sources that must include integrity metadata.
     Allowed values are:
-
     - `inline`
-
       - : The integrity metadata source is inline to the content, such as the [integrity attribute](/en-US/docs/Web/API/HTMLScriptElement/integrity).
         This is the default.
 

files/en-us/web/http/reference/headers/integrity-policy/index.md

@@ -45,18 +45,15 @@ The header values are defined as structured field dictionaries with the followin
 - `blocked-destinations`
   - : A list of [request destinations](/en-US/docs/Web/API/Request/destination) that must include valid integrity metadata.
     Allowed values are:
-
     - `script`
       - : Script resources.
     - `style`
       - : Stylesheet resources.
-- `sources` {{optional_inline}}
 
+- `sources` {{optional_inline}}
   - : A list of integrity sources that must include integrity metadata.
     Allowed values are:
-
     - `inline`
-
       - : The integrity metadata source is inline to the content, such as the [integrity attribute](/en-US/docs/Web/API/HTMLScriptElement/integrity).
         This is the default.
 

files/en-us/web/http/reference/headers/user-agent/firefox/index.md

@@ -83,7 +83,7 @@ Linux is a more diverse platform. Your distribution of Linux might include an ex
 | Linux desktop on x86_64 CPU | Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20100101 Firefox/10.0 |
 
 > [!NOTE]
-> In Firefox 127.0 and later, 32-bit x86 will now be reported as x86_64 in Firefox's User-Agent string, {{domxref("navigator.platform")}}, and {{domxref("navigator.oscpu")}} (see [Firefox 127.0 Release Notes](https://www.mozilla.org/en-US/firefox/127.0/releasenotes/)).
+> In Firefox 127.0 and later, 32-bit x86 will now be reported as x86_64 in Firefox's User-Agent string, {{domxref("navigator.platform")}}, and {{domxref("navigator.oscpu")}} (see [Firefox 127.0 Release Notes](https://www.firefox.com/en-US/firefox/127.0/releasenotes/)).
 
 ## Firefox for Android
 

files/en-us/web/security/attacks/xss/index.md

@@ -203,7 +203,8 @@ However, suppose the template is like this:
 <div \{{ my_input }}></div>
 ```
 
-In this context the browser will treat the `my_input` variable as an HTML attribute. If `my_input` is `onmouseover="alert('XSS')"`, the output encoding provided by Django won't prevent the attack.
+In this context the browser will treat the `my_input` variable as an HTML attribute. Because Django encodes quotes (`"` → `&quot;`, `'` → `&#x27;`), the payload `onmouseover="alert('XSS')"` will not execute.
+However, an unquoted payload like `onmouseover=alert(1)` (or using backticks, ``onmouseover=alert(`XSS`)``) will still execute, because attribute values need not be quoted and backticks are not escaped by default.
 
 The browser uses different rules to process different parts of a web page — HTML elements and their content, HTML attributes, inline styles, inline scripts. The type of encoding that needs to be done is different depending on the context in which the input is being interpolated.
 
@@ -218,7 +219,7 @@ What's safe in one context may be unsafe in another, and it's necessary to under
   <div class=\{{ my_class }}>...</div>
   ```
 
-  An attacker can exploit this to inject an event handler attribute, by using input like `some_id onmouseover="alert('XSS!')"`. To prevent the attack, quote the placeholder:
+  An attacker can exploit this to inject an event handler attribute, by using input like `some_id onmouseover=alert(1)`. To prevent the attack, quote the placeholder:
 
   ```django example-good
     <div class="\{{ my_class }}">...</div>