--- a/browser/pdfviewer/viewer.properties
+++ b/browser/pdfviewer/viewer.properties
@@ -244,8 +244,18 @@ text_annotation_type.alt=[{{type}} Annot
 password_label=Enter the password to open this PDF file.
 password_invalid=Invalid password. Please try again.
 password_ok=OK
 password_cancel=Cancel
 
 printing_not_supported=Warning: Printing is not fully supported by this browser.
 printing_not_ready=Warning: The PDF is not fully loaded for printing.
 web_fonts_disabled=Web fonts are disabled: unable to use embedded PDF fonts.
+
+# Editor
+editor_none.title=Disable Annotation Editing
+editor_none_label=Disable Editing
+editor_free_text.title=Add FreeText Annotation
+editor_free_text_label=FreeText Annotation
+editor_ink.title=Add Ink Annotation
+editor_ink_label=Ink Annotation
+
+freetext_default_content=Enter some text…

--- a/dom/chrome/security/security.properties
+++ b/dom/chrome/security/security.properties
@@ -88,16 +88,19 @@ BlockWorkerWithWrongMimeType=Loading Worker from “%1$S” was blocked because of a disallowed MIME type (“%2$S”).
 BlockModuleWithWrongMimeType=Loading module from “%1$S” was blocked because of a disallowed MIME type (“%2$S”).
 
 # LOCALIZATION NOTE: Do not translate "data: URI".
 BlockTopLevelDataURINavigation=Navigation to toplevel data: URI not allowed (Blocked loading of: “%1$S”)
 BlockSubresourceRedirectToData=Redirecting to insecure data: URI not allowed (Blocked loading of: “%1$S”)
 
 BlockSubresourceFTP=Loading FTP subresource within http(s) page not allowed (Blocked loading of: “%1$S”)
 
+# LOCALIZATION NOTE: Do not translate "file: URI". “%1$S” is the whole URI of the loaded file. “%2$S” is the MIME type e.g. "text/plain".
+BlockFileScriptWithWrongMimeType=Loading script from file: URI (“%1$S”) was blocked because its MIME type (“%2$S”) is not a valid JavaScript MIME type.
+
 RestrictBrowserEvalUsage=eval() and eval-like uses are not allowed in the Parent Process or in System Contexts (Blocked usage in “%1$S”)
 
 # LOCALIZATION NOTE (MixedContentAutoUpgrade):
 # %1$S is the URL of the upgraded request; %2$S is the upgraded scheme.
 MixedContentAutoUpgrade=Upgrading insecure display request ‘%1$S’ to use ‘%2$S’
 # LOCALIZATION NOTE (RunningClearSiteDataValue):
 # %S is the URI of the resource whose data was cleaned up
 RunningClearSiteDataValue=Clear-Site-Data header forced the clean up of “%S” data.
@@ -138,17 +141,16 @@ XFrameOptionsDeny=The loading of “%2$S” in a frame is denied by “X-Frame-Options“ directive set to “%1$S“.
 # LOCALIZATION NOTE: %1$S is the URL of the upgraded request; %2$S is the upgraded scheme.
 HTTPSOnlyUpgradeRequest = Upgrading insecure request “%1$S” to use “%2$S”.
 # LOCALIZATION NOTE: %1$S is the URL of request.
 HTTPSOnlyNoUpgradeException = Not upgrading insecure request “%1$S” because it is exempt.
 # LOCALIZATION NOTE: %1$S is the URL of the failed request; %2$S is an error-code.
 HTTPSOnlyFailedRequest = Upgrading insecure request “%1$S” failed. (%2$S)
 # LOCALIZATION NOTE: %S is the URL of the failed request;
 HTTPSOnlyFailedDowngradeAgain = Upgrading insecure request “%S” failed. Downgrading to “http” again.
-
 # LOCALIZATION NOTE: Hints or indicates a new transaction for a URL is likely coming soon. We use
 # a speculative connection to start a TCP connection so that the resource is immediately ready
 # when the transaction is actually submitted. HTTPS-Only and HTTPS-First will upgrade such
 # speculative TCP connections from http to https.
 # %1$S is the URL of the upgraded speculative TCP connection; %2$S is the upgraded scheme.
 HTTPSOnlyUpgradeSpeculativeConnection = Upgrading insecure speculative TCP connection “%1$S” to use “%2$S”.
 
 # LOCALIZATION NOTE: %S is the URL of the blocked request;

--- a/netwerk/necko.properties
+++ b/netwerk/necko.properties
@@ -45,18 +45,16 @@ CookiePartitionedForeign2=Partitioned cookie or storage access was provided to “%1$S” because it is loaded in the third-party context and dynamic state partitioning is enabled.
 CookieAllowedForOriginByStorageAccessAPI=Storage access granted for origin “%2$S” on “%1$S”.
 # LOCALIZATION NOTE (CookieAllowedForOriginByHeuristic): %2$S and %1$S are URLs.
 CookieAllowedForOriginByHeuristic=Storage access automatically granted for origin “%2$S” on “%1$S”.
 # LOCALIZATION NOTE (CookieAllowedForFpiByHeuristic): %2$S and %1$S are URLs.
 CookieAllowedForFpiByHeuristic=Storage access automatically granted for First-Party isolation “%2$S” on “%1$S”.
 
 # LOCALIZATION NOTE(CookieRejectedNonRequiresSecure2): %1$S is the cookie name. Do not localize "SameSite=None" and "secure".
 CookieRejectedNonRequiresSecure2=Cookie “%1$S” rejected because it has the “SameSite=None” attribute but is missing the “secure” attribute.
-# LOCALIZATION NOTE(CookieRejectedNonRequiresSecureForBeta2): %1$S is the cookie name. %2$S is a URL. Do not localize "SameSite", "SameSite=None" and "secure".
-CookieRejectedNonRequiresSecureForBeta2=Cookie “%1$S” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read %2$S
 # LOCALIZATION NOTE(CookieRejectedNonRequiresSecureForBeta3): %1$S is the cookie name. %2$S is a URL. Do not localize "SameSite", "SameSite=None" and "secure".
 CookieRejectedNonRequiresSecureForBeta3=Cookie “%1$S” will be soon rejected because it has the “SameSite” attribute set to “None” without the “secure” attribute. To know more about the “SameSite“ attribute, read %2$S
 # LOCALIZATION NOTE(CookieLaxForced2): %1$S is the cookie name. Do not localize "SameSite", "Lax" and "SameSite=Lax".
 CookieLaxForced2=Cookie “%1$S” has “SameSite” policy set to “Lax” because it is missing a “SameSite” attribute, and “SameSite=Lax” is the default value for this attribute.
 # LOCALIZATION NOTE(CookieLaxForcedForBeta2): %1$S is the cookie name. %2$S is a URL. Do not localize "SameSite", "Lax" and "SameSite=Lax", "SameSite=None".
 CookieLaxForcedForBeta2=Cookie “%1$S” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read %2$S
 # LOCALIZATION NOTE(CookieSameSiteValueInvalid2): %1$S is cookie name. Do not localize "SameSite", "Lax", "Strict" and "None"
 CookieSameSiteValueInvalid2=Invalid “SameSite“ value for cookie “%1$S”. The supported values are: “Lax“, “Strict“, “None“.
@@ -82,10 +80,13 @@ CookieRejectedSecureButNonHttps=Cookie “%1$S” has been rejected because a non-HTTPS cookie can’t be set as “secure”.
 CookieRejectedThirdParty=Cookie “%1$S” has been rejected as third-party.
 # LOCALIZATION NOTE (CookieRejectedNonsecureOverSecure): %1$S is the cookie name.
 CookieRejectedNonsecureOverSecure=Cookie “%1$S” has been rejected because there is an existing “secure” cookie.
 # LOCALIZATION NOTE (CookieRejectedExpired): %1$S is the cookie name.
 CookieRejectedExpired=Cookie “%1$S” has been rejected because it is already expired.
 # LOCALIZATION NOTE (CookieRejectedForNonSameSiteness): %1$S is the cookie name.
 CookieRejectedForNonSameSiteness=Cookie “%1$S” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict”.
 
+# LOCALIZATION NOTE (CookieBlockedCrossSiteRedirect): %1$S is the cookie name. Do not translate "SameSite", "Lax" or "Strict".
+CookieBlockedCrossSiteRedirect=Cookie “%1$S” with the “SameSite” attribute value “Lax” or “Strict” was omitted because of a cross-site redirect.
+
 # LOCALIZATION NOTE (APIDeprecationWarning): %1$S is the deprecated API; %2$S is the API function that should be used.
 APIDeprecationWarning=Warning: ‘%1$S’ deprecated, please use ‘%2$S’

--- a/toolkit/toolkit/about/aboutAddons.ftl
+++ b/toolkit/toolkit/about/aboutAddons.ftl
@@ -288,16 +288,20 @@ permissions-addon-button = Permissions
 extension-enabled-heading = Enabled
 extension-disabled-heading = Disabled
 theme-enabled-heading = Enabled
 theme-disabled-heading = Disabled
 theme-disabled-heading2 = Saved Themes
 theme-monochromatic-heading = Colourways
 theme-monochromatic-subheading = Vibrant new colourways from { -brand-product-name }. Available for a limited time.
 theme-colorways-button = Try Colourways
+colorway-collection-independent-voices-subheading = Make { -brand-short-name } feel a little more you.
+# Variables:
+#   $expiryDate (string) - date on which the colorway collection expires.
+colorway-collection-expiry-date-span = Expires { DATETIME($expiryDate, month: "long", day: "numeric") }
 plugin-enabled-heading = Enabled
 plugin-disabled-heading = Disabled
 dictionary-enabled-heading = Enabled
 dictionary-disabled-heading = Disabled
 locale-enabled-heading = Enabled
 locale-disabled-heading = Disabled
 sitepermission-enabled-heading = Enabled
 sitepermission-disabled-heading = Disabled

--- a/toolkit/toolkit/pictureinpicture/pictureinpicture.ftl
+++ b/toolkit/toolkit/pictureinpicture/pictureinpicture.ftl
@@ -1,22 +1,22 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 pictureinpicture-player-title = Picture-in-Picture
-
 pictureinpicture-pause =
     .aria-label = Pause
 pictureinpicture-play =
     .aria-label = Play
-
 pictureinpicture-mute =
     .aria-label = Mute
 pictureinpicture-unmute =
     .aria-label = Unmute
-
 pictureinpicture-unpip =
     .aria-label = Send back to tab
-
 pictureinpicture-close =
     .aria-label = Close
-
+pictureinpicture-subtitles-label = Subtitles
+pictureinpicture-font-size-label = Font size
+pictureinpicture-font-size-small = Small
+pictureinpicture-font-size-medium = Medium
+pictureinpicture-font-size-large = Large