-------------------------------------------------------------------

Thu Dec  2 20:32:42 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- remove x-scheme-handler/ftp from firefox.desktop boo#1193321

-------------------------------------------------------------------

Thu Nov 25 20:21:07 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Drop unused libidl-devel BuildRequires.

-------------------------------------------------------------------

Tue Nov 23 22:00:38 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.2:

  * Update preference design for Firefox Suggest for improved clarity

  * Resolved general instability/crashes on Linux caused by a file

    descriptor leak when backgrounding tabs using WebGL

    (bmo#1741997)

-------------------------------------------------------------------

Fri Nov  5 18:02:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.1:

  * fixes for other platforms

-------------------------------------------------------------------

Sat Oct 30 07:52:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 94.0

  * https://www.mozilla.org/en-US/firefox/94.0/releasenotes

  MFSA 2021-48 (bsc#1192250)

  * CVE-2021-38503 (bmo#1729517)

    iframe sandbox rules did not apply to XSLT stylesheets

  * CVE-2021-38504 (bmo#1730156)

    Use-after-free in file picker dialog

  * CVE-2021-38505 (bmo#1730194)

    Windows 10 Cloud Clipboard may have recorded sensitive user data

  * CVE-2021-38506 (bmo#1730750)

    Firefox could be coaxed into going into fullscreen mode

    without notification or warning

  * CVE-2021-38507 (bmo#1730935)

    Opportunistic Encryption in HTTP2 could be used to bypass the

    Same-Origin-Policy on services hosted on other ports

  * MOZ-2021-0003 (bmo#1736886)

    Universal XSS in Firefox for Android via QR Code URLs

  * CVE-2021-38508 (bmo#1366818)

    Permission Prompt could be overlaid, resulting in user

    confusion and potential spoofing

  * MOZ-2021-0004 (bmo#1659155)

    Web Extensions could access pre-redirect URL when their

    context menu was triggered by a user

  * CVE-2021-38509 (bmo#1718571)

    Javascript alert box could have been spoofed onto an

    arbitrary domain

  * CVE-2021-38510 (bmo#1731779)

    Download Protections were bypassed by .inetloc files on Mac OS

  * MOZ-2021-0005 (bmo#1719203)

    'Copy Image Link' context menu action could have been abused

    to see authentication tokens

  * MOZ-2021-0006 (bmo#1724233)

    URL Parsing may incorrectly parse internationalized domains

  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048, bmo#1735152)

    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

- removed obsolete patches

  * mozilla-bmo1602730.patch

  * mozilla-bmo1725828.patch

  * mozilla-bmo1729124.patch

- requires

  NSS >= 3.71

  rust >= 1.53

- fix Plasma detection (boo#1191825)

- fix Link error "undefined hidden symbol:"

  https://github.com/openSUSE/firefox-maintenance/issues/37

-------------------------------------------------------------------

Tue Oct 26 19:48:24 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires

- (re-)enable LTO on Tumbleweed

-------------------------------------------------------------------

Wed Oct 20 06:49:52 UTC 2021 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Rebase mozilla-sandbox-fips.patch to punch another hole in the

  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled

  from within the newly introduced socket process sandbox.

  This fixes bsc#1191815 and bsc#1190141

-------------------------------------------------------------------

Mon Oct 18 12:44:44 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix build on aarch64 (bmo#1729124)

  * mozilla-bmo1729124.patch

-------------------------------------------------------------------

Fri Oct  1 18:33:33 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 93.0

  * supports the new AVIF image format

  * PDF viewer now supports filling more forms (XFA-based forms)

  * now blocks downloads that rely on insecure connections,

    protecting against potentially malicious or unsafe downloads

  * Improved web compatibility for privacy protections with SmartBlock 3.0

  * Introducing a new referrer tracking protection in Strict Tracking

    Protection and Private Browsing

  * TLS ciphersuites that use 3DES have been disabled. Such

    ciphersuites can only be enabled when deprecated versions of

    TLS are also enabled

  * The download panel now follows the Firefox visual styles

  MFSA 2021-43 (bsc#1191332)

  * CVE-2021-38496 (bmo#1725335)

    Use-after-free in MessageTask

  * CVE-2021-38497 (bmo#1726621)

    Validation message could have been overlaid on another origin

  * CVE-2021-38498 (bmo#1729642)

    Use-after-free of nsLanguageAtomService object

  * CVE-2021-32810 (bmo#1729813)

    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)

    Data race in crossbeam-deque

  * CVE-2021-38500 (bmo#1725854, bmo#1728321)

    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,

    and Firefox ESR 91.2

  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)

    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2

  * CVE-2021-38499 (bmo#1667102, bmo#1723170, bmo#1725356, bmo#1727364)

    Memory safety bugs fixed in Firefox 93

- removed obsolete mozilla-bmo1708709.patch

- require NSS >= 3.70

- allow to override wayland detection by defining MOZ_ENABLE_WAYLAND

  explicitely as 0 or 1

- fix aarch64 build by updating constraints

- add mozilla-bmo1725828.patch to fix widevine (bsc#1190842)

- add mozilla-bmo531915.patch to fix build for i586

-------------------------------------------------------------------

Sat Sep 25 10:10:56 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 92.0.1

  * Fixed: Fixes an issue where audio playback was not working on

    some Linux systems (bmo#1730499)

  * Fixed: Fixes issues with the findbar close button on

    different operating systems (bmo#1728368)

-------------------------------------------------------------------

Mon Sep  6 10:16:28 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 92.0

  * More secure connections: Firefox can now automatically upgrade to

    HTTPS using HTTPS RR as Alt-Svc headers

  * Full-range color levels are now supported for video playback on

    many systems

  MFSA 2021-38 (bsc#1190269)

  * CVE-2021-29993 (bmo#1708544, bmo#1708767, bmo#1712240,

    bmo#1712242, bmo#1729259)

    Handling custom intents could lead to crashes and UI spoofs

  * CVE-2021-38491 (bmo#1551886)

    Mixed-Content-Blocking was unable to check opaque origins

  * CVE-2021-38492 (bmo#1721107)

    Navigating to `mk:` URL scheme could load Internet Explorer

  * CVE-2021-38493 (bmo#1723391, bmo#1724101, bmo#1724107)

    Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and

    Firefox ESR 91.1

  * CVE-2021-38494 (bmo#1723920, bmo#1725638)

    Memory safety bugs fixed in Firefox 92

- updated appdata

- remove mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch

  (does not apply anymore; unclear if obsolete)

- bring back mozilla-silence-no-return-type.patch and

  run post-build-checks everywhere again

- requires NSS 3.69.1

-------------------------------------------------------------------

Tue Aug 31 00:33:39 UTC 2021 - Atri Bhattacharya <badshah400@gmail.com>

- Add mozilla-bmo1708709.patch: On [wayland] popup can be wrongly

  repositioned due to rounding errors when font scaling != 1

  (bmo#1708709); patch taken from upstream bug report and rebased

  to apply cleanly against current version.

-------------------------------------------------------------------

Sun Aug 29 14:45:29 UTC 2021 - Martin Liška <mliska@suse.cz>

- Bump using with GCC (tested locally).

-------------------------------------------------------------------

Fri Aug 27 22:47:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 91.0.2:

  * Fixed: Firefox no longer clears authentication data when

    purging trackers, to avoid repeatedly prompting for a

    password (bmo#1721084)

-------------------------------------------------------------------

Wed Aug 18 06:34:01 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 91.0.1

  * Fixed an issue causing buttons on the tab bar to be resized when

    loading certain websites (bmo#1704404)

  * Fixed an issue which caused tabs from private windows to be

    visible in non-private windows when viewing switch-to-tab results

    in the address bar panel (bmo#1720369)

  * Various stability fixes

  MFSA 2021-37 (bsc#1189547)

  * CVE-2021-29991 (bmo#1724896)

    Header Splitting possible with HTTP/3 Responses

-------------------------------------------------------------------

Mon Aug  9 14:55:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 91.0

  MFSA 2021-33 (bsc#1188891)

  * CVE-2021-29986 (bmo#1696138)

    Race condition when resolving DNS names could have led to

    memory corruption

  * CVE-2021-29981 (bmo#1707774)

    Live range splitting could have led to conflicting

    assignments in the JIT

  * CVE-2021-29988 (bmo#1717922)

    Memory corruption as a result of incorrect style treatment

  * CVE-2021-29983 (bmo#1719088)

    Firefox for Android could get stuck in fullscreen mode

  * CVE-2021-29984 (bmo#1720031)

    Incorrect instruction reordering during JIT optimization

  * CVE-2021-29980 (bmo#1722204)

    Uninitialized memory in a canvas object could have led to

    memory corruption

  * CVE-2021-29987 (bmo#1716129)

    Users could have been tricked into accepting unwanted

    permissions on Linux

  * CVE-2021-29985 (bmo#1722083)

    Use-after-free media channels

  * CVE-2021-29982 (bmo#1715318)

    Single bit data leak due to incorrect JIT optimization and

    type confusion

  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,

    bmo#1719998, bmo#1720568)

    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13

  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,

    bmo#1719319, bmo#1722073)

    Memory safety bugs fixed in Firefox 91

- requires

  * rustc/cargo >= 1.51

  * NSPR >= 4.32

  * NSS >= 3.68

- force-disable webrender on BE platforms

-------------------------------------------------------------------

Sat Jul 24 07:15:54 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 90.0.2:

  * Changed: Updates to support DoH Canada rollout (bmo#1713036)

  * Fixed: Fixed truncated output when printing (bmo#1720621)

  * Fixed: Fixed menu styling on some Gtk themes (bmo#1720441,

    bmo#1720874)

-------------------------------------------------------------------

Mon Jul 19 20:08:56 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 90.0.1 (boo#1188480):

  * Fixed: Fixed busy looping processing some HTTP3 responses

    (bmo#1720079)

  * Fixed: Fixed transient errors authenticating with some smart

    cards (bmo#1715325)

  * Fixed: Fixed a rare crash on shutdown (bmo#1707057)

  * Fixed: Fixed a race on startup that caused about:support to

    end up empty after upgrade (bmo#1717894, boo#1188330)

-------------------------------------------------------------------

Sun Jul 11 08:53:02 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 90.0

  MFSA 2021-28 (bsc#1188275)

  * CVE-2021-29970 (bmo#1709976)

    Use-after-free in accessibility features of a document

  * CVE-2021-29971 (bmo#1713638)

    Granted permissions only compared host; omitting scheme and

    port on Android

  * CVE-2021-30547 (bmo#1715766)

    Out of bounds write in ANGLE

  * CVE-2021-29972 (bmo#1696816)

    Use of out-of-date library included use-after-free

    vulnerability

  * CVE-2021-29973 (bmo#1701932)

    Password autofill on HTTP websites was enabled without user

    interaction on Android

  * CVE-2021-29974 (bmo#1704843)

    HSTS errors could be overridden when network partitioning was

    enabled

  * CVE-2021-29975 (bmo#1713259)

    Text message could be overlaid on top of another website

  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,

    bmo#1711576, bmo#1714391)

    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12

  * CVE-2021-29977 (bmo#1665836, bmo#1686138, bmo#1704316,

    bmo#1706314, bmo#1709931, bmo#1712084, bmo#1712357,

    bmo#1714066)

    Memory safety bugs fixed in Firefox 90

- requires

  NSPR 4.31

  NSS 3.66

- Gtk2 support removed (was only for Flash plugin before)

-------------------------------------------------------------------

Wed Jun 23 16:54:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 89.0.2 (boo#1187648):

  * Fix occasional hangs with Software WebRender on Linux (bmo#1708224)

-------------------------------------------------------------------

Sat Jun 19 09:00:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 89.0.1 (boo#1187475):

  * Updated translations, including full Spanish (Mexico)

    localization and other improvements (bmo#1714946)

  * Fix various font related regressions (bmo#1694174)

  * Linux: Fix performance and stability regressions with

    WebRender (bmo#1715895, bmo#1715902)

  * Enterprise: Fix for the `DisableDeveloperTools` policy not

    having effect anymore (bmo#1715777)

  * Linux: Fix broken scrollbars on some GTK themes (bmo#1714103)

  * Various stability fixes

-------------------------------------------------------------------

Sat May 29 20:55:56 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 89.0

  * UI redesign

  * The Event Timing API is now supported

  * The CSS forced-colors media query is now supported

  MFSA 2021-23 (bsc#1186696)

  * CVE-2021-29965 (bmo#1709257)

    Password Manager on Firefox for Android susceptible to domain

    spoofing

  * CVE-2021-29960 (bmo#1675965)

    Filenames printed from private browsing mode incorrectly

    retained in preferences

  * CVE-2021-29961 (bmo#1700235)

    Firefox UI spoof using `<select>` elements and CSS scaling

  * CVE-2021-29963 (bmo#1705068)

    Shared cookies for search suggestions in private browsing mode

  * CVE-2021-29964 (bmo#1706501)

    Out of bounds-read when parsing a `WM_COPYDATA` message

  * CVE-2021-29959 (bmo#1395819)

    Devices could be re-enabled without additional permission prompt

  * CVE-2021-29962 (bmo#1701673)

    No rate-limiting for popups on Firefox for Android

  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,

    bmo#1704722, bmo#1706041)

    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11

  * CVE-2021-29966 (bmo#1660307, bmo#1686154, bmo#1702948, bmo#1708124)

    Memory safety bugs fixed in Firefox 89

- require

  NSS >= 3.64

  rust-cbindgen >= 0.19.0

- do not rely on nodejs10 packagename anymore

- updated mozilla.keyring

- switched TW/x86_64 to clang as the last platform due to

  https://bugs.gentoo.org/792705

- but LTO with clang is broken in TW so disable LTO for it

  https://bugs.llvm.org/show_bug.cgi?id=47872

-------------------------------------------------------------------

Thu May  6 13:40:10 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Relax RAM and disk constraints for aarch64

-------------------------------------------------------------------

Wed May  5 15:13:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 88.0.1

  * Fixed: Resolved an issue caused by a recent Widevine plugin

    update which prevented some purchased video content from

    playing correctly (bmo#1705138)

  * Fixed: Fixed corruption of videos playing on Twitter or

    WebRTC calls on some Gen6 Intel graphics chipsets

    (bmo#1708937)

  * Fixed: Fixed menulists in Preferences being unreadable for

    users with High Contrast Mode enabled (bmo#1706496)

  MFSA 2021-20 (bsc#1185633)

  * CVE-2021-29952 (bmo#1704227)

    Race condition in Web Render Components

- devel package: move macros to /usr/lib/rpm/macros.d (boo#1185658)

-------------------------------------------------------------------

Sun May  2 12:03:26 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- add compatibility for libavcodec58_134

-------------------------------------------------------------------

Sun Apr 18 09:01:32 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 88.0

  * New: PDF forms now support JavaScript embedded in PDF files.

    Some PDF forms use JavaScript for validation and other

    interactive features

  * New: Print updates: Margin units are now localized

  * New: Smooth pinch-zooming using a touchpad is now supported

    on Linux

  * New: To protect against cross-site privacy leaks, Firefox now

    isolates window.name data to the website that created it.

    Learn more

  * Changed: Firefox will not prompt for access to your

    microphone or camera if you’ve already granted access to the

    same device on the same site in the same tab within the past

    50 seconds. This new grace period reduces the number of times

    you’re prompted to grant device access

  * Changed: The ‘Take a Screenshot’ feature was removed from the

    Page Actions menu in the url bar. To take a screenshot,

    right-click to open the context menu. You can also add a

    screenshots shortcut directly to your toolbar via the

    Customize menu. Open the Firefox menu and select Customize…

  * Changed: FTP support has been disabled, and its full removal

    is planned for an upcoming release. Addressing this security

    risk reduces the likelihood of an attack while also removing

    support for a non-encrypted protocol

  * Developer: Introduced a new toggle button in the Network

    panel for switching between JSON formatted HTTP response and

    raw data (as received over the wire).

    !enter image description here