-------------------------------------------------------------------

Sun Jan 30 23:58:34 UTC 2022 - Dirk Müller <dmueller@suse.com>

  over 2 GB of disk space usage without benefit on OBS builds

- build with rust-simd like upstream does

  does as well and it saves ~ 2GB of writes

- use %limit on x86_64 to scale down to less capable workers

- disable install stripping so that debuginfo is useful

- use autopatch

- cleanup constraints to specify only jobs, physicalmemory

  and memoryperjob to be more flexible on which host to build

  on

-------------------------------------------------------------------

Fri Jan 28 15:26:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 96.0.3 (bsc#1195230)

  * Fixed an issue that allowed unexpected data to be submitted in

    some of our search telemetry (bmo#1752317)

-------------------------------------------------------------------

Mon Jan 24 07:42:03 UTC 2022 - Martin Liška <mliska@suse.cz>

- Enable -fimplicit-constexpr for GCC 12+.

-------------------------------------------------------------------

Thu Jan 20 23:21:44 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 96.0.2

  * Fix an issue that caused tab height to display inconsistently

    on Linux when audio was played (bmo#1714276)

  * Fix an issue that caused Lastpass dropdowns to appear blank in

    Private Browsing mode (bmo#1748158)

  * Fix a crash encountered when resizing a Facebook app

    (bmo#1746084)

-------------------------------------------------------------------

Fri Jan 14 16:56:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 96.0.1

  * Fixed: Improvements to make the parsing of content-length

    headers more robust (bmo#1749957, boo#1194677)

-------------------------------------------------------------------

Sat Jan  8 10:32:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 96.0

  * https://www.mozilla.org/en-US/firefox/96.0/releasenotes

  MFSA 2022-01 (bsc#1194547)

  * CVE-2022-22746 (bmo#1735071)

    Calling into reportValidity could have lead to fullscreen

    window spoof

  * CVE-2022-22743 (bmo#1739220)

    Browser window spoof using fullscreen mode

  * CVE-2022-22742 (bmo#1739923)

    Out-of-bounds memory access when inserting text in edit mode

  * CVE-2022-22741 (bmo#1740389)

    Browser window spoof using fullscreen mode

  * CVE-2022-22740 (bmo#1742334)

    Use-after-free of ChannelEventQueue::mOwner

  * CVE-2022-22738 (bmo#1742382)

    Heap-buffer-overflow in blendGaussianBlur

  * CVE-2022-22737 (bmo#1745874)

    Race condition when playing audio files

  * CVE-2021-4140 (bmo#1746720)

    Iframe sandbox bypass with XSLT

  * CVE-2022-22750 (bmo#1566608)

    IPC passing of resource handles could have lead to sandbox

    bypass

  * CVE-2022-22749 (bmo#1705094)

    Lack of URL restrictions when scanning QR codes

  * CVE-2022-22748 (bmo#1705211)

    Spoofed origin on external protocol launch dialog

  * CVE-2022-22745 (bmo#1735856)

    Leaking cross-origin URLs through securitypolicyviolation

    event

  * CVE-2022-22744 (bmo#1737252)

    The 'Copy as curl' feature in DevTools did not fully escape

    website-controlled data, potentially leading to command

    injection

  * CVE-2022-22747 (bmo#1735028)

    Crash when handling empty pkcs7 sequence

  * CVE-2022-22736 (bmo#1742692)

    Potential local privilege escalation when loading modules

    from the install directory.

  * CVE-2022-22739 (bmo#1744158)

    Missing throttling on external protocol launch dialog

  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,

    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,

    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)

    Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

  * CVE-2022-22752 (bmo#1740534, bmo#1741210, bmo#1742770)

    Memory safety bugs fixed in Firefox 96

- removed obsolete patches

  * mozilla-bmo1745560.patch

  * mozilla-bmo1744896.patch

  * mozilla-sandbox-fips.patch

- requires

  NSPR >= 4.33

  NSS  >= 3.73.1

-------------------------------------------------------------------

Tue Dec 28 17:45:28 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Add upstream patches:

  * mozilla-bmo1745560.patch: Fix build against wayland 1.20.

  * mozilla-bmo1744896.patch: Create WaylandVsyncSource on window

    creation

-------------------------------------------------------------------

Mon Dec 20 21:57:30 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.2

  * Addresses frequent crashes experienced by users with C/E/Z-Series

    "Bobcat" CPUs running on Windows 7, 8, and 8.1.

- updated constraints for ppc and x86-64

-------------------------------------------------------------------

Fri Dec 17 13:49:16 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.1 (bsc#1193845)

  * Fixed frequent

    MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING error

    messages when trying to connect to various microsoft.com

    domains (bmo#1745600)

  * Fix for a WebRender crash on some Linux/X11 systems (bmo#1741956)

  * Fix for a frequent Windows shutdown crash (bmo#1738984)

  * Fix websites contrast issues for some Linux users with

    Dark mode set at OS level (bmo#1740518)

-------------------------------------------------------------------

Sat Dec  4 12:07:21 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0

  * You can now move the Picture-in-Picture toggle button to the

    opposite side of the video. Simply look for the new context menu

    option Move Picture-in-Picture Toggle to Left (Right) Side.

  * To better protect Firefox users against side-channel attacks such

    as Spectre, Site Isolation is now enabled for all Firefox 95 users.

  * https://www.mozilla.org/en-US/firefox/95.0/releasenotes

  MFSA 2021-52 (bsc#1193485)

  * CVE-2021-43536 (bmo#1730120)

    URL leakage when navigating while executing asynchronous

    function

  * CVE-2021-43537 (bmo#1738237)

    Heap buffer overflow when using structured clone

  * CVE-2021-43538 (bmo#1739091)

    Missing fullscreen and pointer lock notification when

    requesting both

  * CVE-2021-43539 (bmo#1739683)

    GC rooting failure when calling wasm instance methods

  * MOZ-2021-0010 (bmo#1735852)

    Use-after-free in fullscreen objects on MacOS

  * CVE-2021-43540 (bmo#1636629)

    WebExtensions could have installed persistent ServiceWorkers

  * CVE-2021-43541 (bmo#1696685)

    External protocol handler parameters were unescaped

  * CVE-2021-43542 (bmo#1723281)

    XMLHttpRequest error codes could have leaked the existence of

    an external protocol handler

  * CVE-2021-43543 (bmo#1738418)

    Bypass of CSP sandbox directive when embedding

  * CVE-2021-43544 (bmo#1739934)

    Receiving a malicious URL as text through a SEND intent could

    have led to XSS

  * CVE-2021-43545 (bmo#1720926)

    Denial of Service when using the Location API in a loop

  * CVE-2021-43546 (bmo#1737751)

    Cursor spoofing could overlay user interface when native

    cursor is zoomed

  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,

    bmo#1737009, bmo#1739372, bmo#1739421)

    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4

- requires

  NSS >= 3.72

-------------------------------------------------------------------

Thu Dec  2 20:32:42 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- remove x-scheme-handler/ftp from firefox.desktop boo#1193321

-------------------------------------------------------------------

Thu Nov 25 20:21:07 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Drop unused libidl-devel BuildRequires.

-------------------------------------------------------------------

Tue Nov 23 22:00:38 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.2:

  * Update preference design for Firefox Suggest for improved clarity

  * Resolved general instability/crashes on Linux caused by a file

    descriptor leak when backgrounding tabs using WebGL

    (bmo#1741997)

-------------------------------------------------------------------

Fri Nov  5 18:02:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.1:

  * fixes for other platforms

-------------------------------------------------------------------

Sat Oct 30 07:52:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 94.0

  * https://www.mozilla.org/en-US/firefox/94.0/releasenotes

  MFSA 2021-48 (bsc#1192250)

  * CVE-2021-38503 (bmo#1729517)

    iframe sandbox rules did not apply to XSLT stylesheets

  * CVE-2021-38504 (bmo#1730156)

    Use-after-free in file picker dialog

  * CVE-2021-38505 (bmo#1730194)

    Windows 10 Cloud Clipboard may have recorded sensitive user data

  * CVE-2021-38506 (bmo#1730750)

    Firefox could be coaxed into going into fullscreen mode

    without notification or warning

  * CVE-2021-38507 (bmo#1730935)

    Opportunistic Encryption in HTTP2 could be used to bypass the

    Same-Origin-Policy on services hosted on other ports

  * MOZ-2021-0003 (bmo#1736886)

    Universal XSS in Firefox for Android via QR Code URLs

  * CVE-2021-38508 (bmo#1366818)

    Permission Prompt could be overlaid, resulting in user

    confusion and potential spoofing

  * MOZ-2021-0004 (bmo#1659155)

    Web Extensions could access pre-redirect URL when their

    context menu was triggered by a user

  * CVE-2021-38509 (bmo#1718571)

    Javascript alert box could have been spoofed onto an

    arbitrary domain

  * CVE-2021-38510 (bmo#1731779)

    Download Protections were bypassed by .inetloc files on Mac OS

  * MOZ-2021-0005 (bmo#1719203)

    'Copy Image Link' context menu action could have been abused

    to see authentication tokens

  * MOZ-2021-0006 (bmo#1724233)

    URL Parsing may incorrectly parse internationalized domains

  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048, bmo#1735152)

    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

- removed obsolete patches

  * mozilla-bmo1602730.patch

  * mozilla-bmo1725828.patch

  * mozilla-bmo1729124.patch

- requires

  NSS >= 3.71

  rust >= 1.53

- fix Plasma detection (boo#1191825)

- fix Link error "undefined hidden symbol:"

  https://github.com/openSUSE/firefox-maintenance/issues/37

-------------------------------------------------------------------

Tue Oct 26 19:48:24 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires

- (re-)enable LTO on Tumbleweed

-------------------------------------------------------------------

Wed Oct 20 06:49:52 UTC 2021 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Rebase mozilla-sandbox-fips.patch to punch another hole in the

  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled

  from within the newly introduced socket process sandbox.

  This fixes bsc#1191815 and bsc#1190141

-------------------------------------------------------------------

Mon Oct 18 12:44:44 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix build on aarch64 (bmo#1729124)

  * mozilla-bmo1729124.patch

-------------------------------------------------------------------

Fri Oct  1 18:33:33 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 93.0

  * supports the new AVIF image format

  * PDF viewer now supports filling more forms (XFA-based forms)

  * now blocks downloads that rely on insecure connections,

    protecting against potentially malicious or unsafe downloads

  * Improved web compatibility for privacy protections with SmartBlock 3.0

  * Introducing a new referrer tracking protection in Strict Tracking

    Protection and Private Browsing

  * TLS ciphersuites that use 3DES have been disabled. Such

    ciphersuites can only be enabled when deprecated versions of

    TLS are also enabled

  * The download panel now follows the Firefox visual styles

  MFSA 2021-43 (bsc#1191332)

  * CVE-2021-38496 (bmo#1725335)

    Use-after-free in MessageTask

  * CVE-2021-38497 (bmo#1726621)

    Validation message could have been overlaid on another origin

  * CVE-2021-38498 (bmo#1729642)

    Use-after-free of nsLanguageAtomService object

  * CVE-2021-32810 (bmo#1729813)

    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)

    Data race in crossbeam-deque

  * CVE-2021-38500 (bmo#1725854, bmo#1728321)

    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,

    and Firefox ESR 91.2

  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)

    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2

  * CVE-2021-38499 (bmo#1667102, bmo#1723170, bmo#1725356, bmo#1727364)

    Memory safety bugs fixed in Firefox 93

- removed obsolete mozilla-bmo1708709.patch

- require NSS >= 3.70

- allow to override wayland detection by defining MOZ_ENABLE_WAYLAND

  explicitely as 0 or 1

- fix aarch64 build by updating constraints

- add mozilla-bmo1725828.patch to fix widevine (bsc#1190842)

- add mozilla-bmo531915.patch to fix build for i586

-------------------------------------------------------------------

Sat Sep 25 10:10:56 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 92.0.1

  * Fixed: Fixes an issue where audio playback was not working on

    some Linux systems (bmo#1730499)

  * Fixed: Fixes issues with the findbar close button on

    different operating systems (bmo#1728368)

-------------------------------------------------------------------

Mon Sep  6 10:16:28 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 92.0

  * More secure connections: Firefox can now automatically upgrade to

    HTTPS using HTTPS RR as Alt-Svc headers

  * Full-range color levels are now supported for video playback on

    many systems

  MFSA 2021-38 (bsc#1190269)

  * CVE-2021-29993 (bmo#1708544, bmo#1708767, bmo#1712240,

    bmo#1712242, bmo#1729259)

    Handling custom intents could lead to crashes and UI spoofs

  * CVE-2021-38491 (bmo#1551886)

    Mixed-Content-Blocking was unable to check opaque origins

  * CVE-2021-38492 (bmo#1721107)

    Navigating to `mk:` URL scheme could load Internet Explorer

  * CVE-2021-38493 (bmo#1723391, bmo#1724101, bmo#1724107)

    Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and

    Firefox ESR 91.1

  * CVE-2021-38494 (bmo#1723920, bmo#1725638)

    Memory safety bugs fixed in Firefox 92

- updated appdata

- remove mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch

  (does not apply anymore; unclear if obsolete)

- bring back mozilla-silence-no-return-type.patch and

  run post-build-checks everywhere again

- requires NSS 3.69.1

-------------------------------------------------------------------

Tue Aug 31 00:33:39 UTC 2021 - Atri Bhattacharya <badshah400@gmail.com>

- Add mozilla-bmo1708709.patch: On [wayland] popup can be wrongly

  repositioned due to rounding errors when font scaling != 1

  (bmo#1708709); patch taken from upstream bug report and rebased

  to apply cleanly against current version.

-------------------------------------------------------------------

Sun Aug 29 14:45:29 UTC 2021 - Martin Liška <mliska@suse.cz>

- Bump using with GCC (tested locally).

-------------------------------------------------------------------

Fri Aug 27 22:47:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 91.0.2:

  * Fixed: Firefox no longer clears authentication data when

    purging trackers, to avoid repeatedly prompting for a

    password (bmo#1721084)

-------------------------------------------------------------------

Wed Aug 18 06:34:01 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 91.0.1

  * Fixed an issue causing buttons on the tab bar to be resized when

    loading certain websites (bmo#1704404)

  * Fixed an issue which caused tabs from private windows to be

    visible in non-private windows when viewing switch-to-tab results

    in the address bar panel (bmo#1720369)

  * Various stability fixes

  MFSA 2021-37 (bsc#1189547)

  * CVE-2021-29991 (bmo#1724896)

    Header Splitting possible with HTTP/3 Responses

-------------------------------------------------------------------

Mon Aug  9 14:55:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 91.0

  MFSA 2021-33 (bsc#1188891)

  * CVE-2021-29986 (bmo#1696138)

    Race condition when resolving DNS names could have led to

    memory corruption

  * CVE-2021-29981 (bmo#1707774)

    Live range splitting could have led to conflicting

    assignments in the JIT

  * CVE-2021-29988 (bmo#1717922)

    Memory corruption as a result of incorrect style treatment

  * CVE-2021-29983 (bmo#1719088)

    Firefox for Android could get stuck in fullscreen mode

  * CVE-2021-29984 (bmo#1720031)

    Incorrect instruction reordering during JIT optimization

  * CVE-2021-29980 (bmo#1722204)

    Uninitialized memory in a canvas object could have led to

    memory corruption

  * CVE-2021-29987 (bmo#1716129)

    Users could have been tricked into accepting unwanted

    permissions on Linux

  * CVE-2021-29985 (bmo#1722083)

    Use-after-free media channels

  * CVE-2021-29982 (bmo#1715318)

    Single bit data leak due to incorrect JIT optimization and

    type confusion

  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,