fix(computer-use): re-pin Chromium to 150.0.7871.124, the current trixie build

[stubbi]

Thinking Path

• Mitos ships a headless Chromium + CDP template (images/computer-use) for browser-automation sandboxes; the microVM is the isolation boundary and Chromium runs with --no-sandbox.
• The Dockerfile pins Chromium to an exact version because the pin has a launch-crash history (150.0.7871.46 SIGTRAPed), and the required docker-build check runs a CDP smoke that will not merge a non-launching browser.
• Debian's security pocket keeps only its latest build, so an exact pin is a moving target: it rotated 150.0.7871.114 out of the archive, so apt now fails with "Version '150.0.7871.114-1~deb13u1' ... was not found" (exit 100).
• That turns the required docker-build check red on main and on every open PR (a docs-only PR fails identically), blocking the whole merge queue, so it needs fixing now.
• This pull request re-pins to 150.0.7871.124, the version the trixie security pocket currently ships.
• The benefit is that docker-build goes green again repo-wide, and the CDP smoke gate confirms the new build launches before this merges.

Linked Issues or Issue Description

No issue filed; this is a live main-breaking regression. The computer-use image pinned Chromium 150.0.7871.114, which Debian rotated out of the trixie security pocket, failing every docker-build at the apt install step. Re-pin to the current build. Related to the computer-use pin history noted in the Dockerfile.

What Changed

• images/computer-use/Dockerfile: CHROMIUM_VERSION 150.0.7871.114 -> 150.0.7871.124 (the current trixie security build), with the pin-history comment updated to record the rotation.

Verification

• Confirmed 150.0.7871.124-1~deb13u1 is the version currently published for chromium in Debian trixie (packages.debian.org/trixie/chromium).
• The required docker-build job builds this image and runs the CDP smoke (launch Chromium, assert /json/version returns a webSocketDebuggerUrl); that is the gate that proves the new build launches and binds the debugging port. It must pass before merge.

Risks

Low risk. A same-line security point bump (150.0.7871.114 -> .124), well past the .46 build that SIGTRAPed; the CDP smoke gate fails the build if it does not launch. The moving-pin treadmill remains (the next rotation will need another bump); a durable fix (a snapshot.debian.org pin) is out of scope for this unblock.

Model Used

Claude Opus 4.8 (claude-opus-4-8), 1M context, extended thinking.

Summary by CodeRabbit

• Bug Fixes
  • Updated the bundled Chromium version to improve runtime installation reliability.
  • Ensured Chromium-related components use the matching updated version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2d939642-7867-40ca-ba7b-32a8cdc7e20d

📥 Commits

Reviewing files that changed from the base of the PR and between 1fb5929 and 04c0cb2.

📒 Files selected for processing (1)

• images/computer-use/Dockerfile

---

📝 Walkthrough

Walkthrough

The computer-use Docker image updates its pinned Chromium version from 150.0.7871.114-1~deb13u1 to 150.0.7871.124-1~deb13u1 and revises the associated comment.

Changes

Chromium package pin

Layer / File(s)	Summary
Update Chromium package pin images/computer-use/Dockerfile	The CHROMIUM_VERSION build argument and its explanatory comment are updated for the newer Debian Chromium package version.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• mitos-run/mitos#724: Updates Chromium pinning in the same Dockerfile.
• mitos-run/mitos#899: Updates the same Dockerfile’s Chromium package version pin.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, conventional, and accurately summarizes the Chromium repin.
Description check	✅ Passed	The description covers the required sections and explains the change, verification, risks, and model used.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/chromium-pin-150-124

---

_{Comment @coderabbitai help to get the list of available commands.}