-------------------------------------------------------------------

Sun Jul 30 19:55:49 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 116.0

- require NSS 3.91

- remove obsolete mozilla-fix-top-level-asm.patch

- re-enable LTO

-------------------------------------------------------------------

Fri Jul 28 20:56:00 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 115.0.3

  * fixes for other platforms

- remove bashisms from firefox startup script (boo#1213657)

-------------------------------------------------------------------

Thu Jul 13 13:30:20 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 115.0.2

  * Fixed a bug with displaying a caret in the text editor on some websites

    (bmo#1840804)

  * Fixed a bug with broken audio rendering on some websites (bmo#1841982)

  * Fixed a bug with patternTransform translate using the wrong units

    (bmo#1840746)

  MFSA 2023-26 (bsc#1213230)

  * CVE-2023-3600 (bmo#1839703)

    Use-after-free in workers

-------------------------------------------------------------------

Fri Jul  7 19:39:30 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 115.0.1

  * fixes for other platforms

-------------------------------------------------------------------

Sun Jul  2 16:00:53 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 115.0

  * Support for importing payment methods saved in Chrome-based browser

  * Hardware video decoding is now enabled for Intel GPUs on Linux

  * The Tab Manager dropdown now features close buttons, so tabs

    can be closed more quickly

  * Streamlined the user interface for importing data in from other browsers

  * Users without platform support for H264 video decoding can now

    fallback to Cisco's OpenH264 plugin for playback.

  * Undo and redo are now available in Password fields

  * Changed: On Linux, middle clicks on the new tab button will

    now open the xclipboard contents in the new tab. If the

    xclipboard content is a URL then that URL is opened, any

    other text is opened with your default search provider.

  * Changed: For users with a Firefox Colorways built-in theme,

    the theme will be automatically migrated to the same theme

    hosted on addons.mozilla.org for Firefox profiles that have

    disabled add-ons auto-updates. This will allow users to keep

    their Colorways theme when they are later removed from

    Firefox installer files.

  * Changed: Certain Firefox users may come across a message in

    the extensions panel indicating that their add-ons are not

    allowed on the site currently open. We have introduced a new

    back-end feature to only allow some extensions monitored by

    Mozilla to run on specific websites for various reasons,

    including security concerns.

  * HTML5: The builtin editor now behaves similarly to other

    browsers with `contenteditable` and `designMode` when

    splitting a node, e.g. typing Enter to split a paragraph, and

    also when joining two nodes, e.g. typing Backspace at the

    start of a paragraph to join the paragraph and the previous

    one.

    When a node is split, the builtin editor creates a new node

    after the original one instead of before, i.e. creates the

    right node instead of the left node.

    Similarly, when two nodes are joined, the builtin editor

    deletes the latter node and moves its children to the end of

    the preceding node instead of deleting the former node and

    moving its child to the start of the following node.

  * HTML5: WebRTC application developers can now specify a target

    in milliseconds of media for the jitter buffer to hold.

    Altering the target value allows applications to control the

    tradeoff between playout delay and the risk of running out of

    audio or video frames due to network jitter.

  * HTML5: Change array by copy provides additional methods on

    `Array.prototype` and `TypedArray.prototype` to enable

    changes on the array by returning a new copy of it with the

    change.

  * HTML5: The animation-composition property is now supported,

    allowing a declarative way to define the composite operation

    used when multiple animations affect the same property

    simultaneously.

  * HTML5: Added the URL.canParse() function to allow easy and

    fast checking if URLs are valid and parseable.

  * HTML5: IndexedDB is now also supported in private browsing

    without memory limits thanks to encrypted storage on disk.

    The temporary keys to decrypt the information are hold in RAM

    only and all stored information is purged at the normal end

    of a private browsing session from disk.

  * HTML5: Supports conditions are now supported in CSS import

    rules @import supports(...)

  * Developer: In web development, we rely on third-party

    libraries which you may not be interested in while debugging.

    These can be ignored. Ignoring them means that breakpoints

    will not get hit and they are skipped during stepping.

    You can now choose to **Hide ignore-listed sources** in the

    Developer Tools source tree

  * Developer: We have introduced a new option,

    `devtools.f12_enabled`, that can be utilized to prevent the

    accidental use of the F12 key, which opens the DevTools

    toolbox (bug).

  * Enterprise: You can find information about policy updates and

    enterprise specific bug fixes in the Firefox for Enterprise

    115 Release Notes.

  MFSA 2023-22 (bsc#1212438)

  * CVE-2023-3482 (bmo#1839464)

    Block all cookies bypass for localstorage

  * CVE-2023-37201 (bmo#1826002)

    Use-after-free in WebRTC certificate generation

  * CVE-2023-37202 (bmo#1834711)

    Potential use-after-free from compartment mismatch in SpiderMonkey

  * CVE-2023-37203 (bmo#291640)

    Drag and Drop API may provide access to local system files

  * CVE-2023-37204 (bmo#1832195)

    Fullscreen notification obscured via option element

  * CVE-2023-37205 (bmo#1704420)

    URL spoofing in address bar using RTL characters

  * CVE-2023-37206 (bmo#1813299)

    Insufficient validation of symlinks in the FileSystem API

  * CVE-2023-37207 (bmo#1816287)

    Fullscreen notification obscured

  * CVE-2023-37208 (bmo#1837675)

    Lack of warning when opening Diagcab files

  * CVE-2023-37209 (bmo#1837993)

    Use-after-free in `NotifyOnHistoryReload`

  * CVE-2023-37210 (bmo#1821886)

    Full-screen mode exit prevention

  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,

    bmo#1836550, bmo#1837450)

    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,

    and Thunderbird 102.13

  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206, bmo#1827076,

    bmo#1828690, bmo#1833503, bmo#1835710, bmo#1838587)

    Memory safety bugs fixed in Firefox 115

- Requires NSS 3.90

- Add patches:

  mozilla-rust-disable-future-incompat.patch

  mozilla-bmo1775202.patch

  mozilla-partial-revert-1768632.patch

- removed obsolete mozilla-buildfixes.patch

-------------------------------------------------------------------

Tue Jun 20 19:49:51 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 114.0.2:

  * Several crash fixes

  * Web Extensions: Fixes for 114 regressions in Native Messaging

    support

-------------------------------------------------------------------

Tue Jun 20 06:30:02 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- do not enable LTO as it caused crashes now (boo#1212101)

-------------------------------------------------------------------

Sat Jun 10 14:48:07 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 114.0.1

  * Fix a startup crash (bmo#1837201, boo#1212101)

-------------------------------------------------------------------

Fri Jun  9 11:05:47 UTC 2023 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Only install vaapitest for wayland-enabled builds, where it gets built

- Rebase mozilla-silence-no-return-type.patch

- Rebase s390x-patches, and remove obsolete patches:

  mozilla-bmo1005535.patch mozilla-s390x-skia-gradient.patch

-------------------------------------------------------------------

Mon Jun  5 21:22:19 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 114.0

  MFSA 2023-20 (bsc#1211922)

  * CVE-2023-34414 (bmo#1695986)

    Click-jacking certificate exceptions through rendering lag

  * CVE-2023-34415 (bmo#1811999)

    Site-isolation bypass on sites that allow open redirects to

    data: urls

  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,

    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,

    bmo#1830206, bmo#1830795, bmo#1833339)

    Memory safety bugs fixed in Firefox 114 and Firefox ESR

    102.12

  * CVE-2023-34417 (bmo#1746447, bmo#1820903, bmo#1832832)

    Memory safety bugs fixed in Firefox 114

  * New: Added UI to manage the DNS over HTTPS exception list.

    (bmo#1596847)

  * New: Bookmarks can now be searched from the Bookmarks menu.

    The Bookmarks menu is accessible by adding the *Bookmarks

    menu* button to the toolbar. (bmo#1736937)

  * New: Restrict searches to your local browsing history by

    selecting *Search history* from the History, Library or

    Application menu buttons. (bmo#1736939)

  * New: Mac users can now capture video from their cameras in

    all supported native resolutions. This enables resolutions

    higher than 1280x720. (bmo#1806604)

  * New: It is now possible to reorder the extensions listed in

    the extensions panel. (bmo#1805924)

  * New: Users on macOS, Linux, and Windows 7 can now use FIDO2 /

    WebAuthn authenticators over USB. Some advanced features,

    such as fully passwordless logins, require a PIN to be set on

    the authenticator. (bmo#1814487)

  * New: Pocket Recommended content can now be seen in France,

    Italy, and Spain. (bmo#None)

  * Changed: DNS over HTTPS settings are now part of  the

    *Privacy & Security* section of the *Settings* page and allow

    the user to choose from all the supported modes.

    (bmo#1610741)

  * HTML5: DOM: Added support for ES Modules on DedicatedWorker

    and SharedWorker

  * HTML5: WebTransport is now enabled by default and will be

    going to release with 114. As the original Explainer  notes,

    it enables multiple use-cases that are hard or impossible to

    handle without it, especially for Gaming and live streaming.

    It covers cases that are problematic for alternative

    mechanisms, such as WebSockets.

    Built on top of HTTP3 (HTTP2 support will be coming later).

    The current implementation in Firefox is passing 505 out of

    565 Web-Platform Tests.

  * HTML5: CSS: The `infinity` and `NaN` constants are now

    supported inside the `calc()` function. (bmo#1830759)

  * Developer: The *Copy as cURL* feature, available in the

    Network panel, has been enhanced. It now supports the

    -`-compressed` argument. (bmo#1776120)

  * Developer: The Accessibility Inspector has been improved to

    accurately recognize all the ARIA roles like `banner`,

    `main`, `navigation`, and `contentinfo`, etc. This

    enhancement is particularly beneficial for web developers

    working with ARIA roles to improve web accessibility.

    (bmo#1572512)

  * Developer: Firefox now provides support for the CSS Cascading

    Level 4 `supports()` syntax for `@import` rules. This allows

    for the importation of other stylesheets based on support-

    dependency. In addition, the Inspector panel now accurately

    displays the conditions at the top of the imported rule.

- requires NSS 3.89.1

-------------------------------------------------------------------

Wed May 24 19:26:35 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 113.0.2 (boo#1211696)

  * Fixed: Fixed a bug which could cause Firefox to freeze on

    some pages when loading them with the Developer Tools Web

    Console open (bmo#1828026)

  * Fixed: Fixed a bug which would cause the bookmarks and

    history sidebars to not properly react to the browser window

    being vertically resized (bmo#1831535)

-------------------------------------------------------------------

Sat May 13 20:56:05 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 113.0.1

  * UI fixes for other platforms

- upstream signing key updated

-------------------------------------------------------------------

Tue May  9 21:12:38 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 113.0

  * https://www.mozilla.org/en-US/firefox/113.0/releasenotes

  MFSA 2023-16 (bsc#1211175)

  * CVE-2023-32205 (bmo#1753339, bmo#1753341)

    Browser prompts could have been obscured by popups

  * CVE-2023-32206 (bmo#1824892)

    Crash in RLBox Expat driver

  * CVE-2023-32207 (bmo#1826116)

    Potential permissions request bypass via clickjacking

  * CVE-2023-32208 (bmo#1646034)

    Leak of script base URL in service workers via import()

  * CVE-2023-32209 (bmo#1767194)

    Persistent DoS via favicon image

  * CVE-2023-32210 (bmo#1776755)

    Incorrect principal object ordering

  * CVE-2023-32211 (bmo#1823379)

    Content process crash due to invalid wasm code

  * CVE-2023-32212 (bmo#1826622)

    Potential spoof due to obscured address bar

  * CVE-2023-32213 (bmo#1826666)

    Potential memory corruption in FileReader::DoReadData()

  * MFSA-TMP-2023-0002 (bmo#1814560, bmo#1814790, bmo#1819796)

    Race condition in dav1d decoding

  * CVE-2023-32214 (bmo#1828716)

    Potential DoS via exposed protocol handlers

  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856, bmo#1820210,

    bmo#1821480, bmo#1827019, bmo#1827024, bmo#1827144, bmo#1827359,

    bmo#1830186)

    Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

  * CVE-2023-32216 (bmo#1746479, bmo#1806852, bmo#1815987,

    bmo#1820359, bmo#1823568, bmo#1824803, bmo#1824834, bmo#1825170,

    bmo#1827020, bmo#1828130)

    Memory safety bugs fixed in Firefox 113

- removed obsolete mozilla-bmo1568145.patch

-------------------------------------------------------------------

Sun May  7 19:47:00 UTC 2023 - Aaron Puchert <aaronpuchert@alice-dsl.net>

- Fix i586 build by reducing debug info to -g1. (boo#1210168)

-------------------------------------------------------------------

Tue Apr 25 16:01:07 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 112.0.2

  * Fix a high memory usage issue with animated images in minimized

    (or completely covered) windows, especially when using animated

    themes (bmo#1828587)

  * Fix an issue where Linux users with bitmap fonts installed may

    have had entire sections of text invisible to them on some

    sites (bmo#1827950)

-------------------------------------------------------------------

Fri Apr 21 09:48:25 UTC 2023 - Manfred Hollstein <manfred.h@gmx.net>

- Include Leap 15.5 in check for which python version is required.

-------------------------------------------------------------------

Thu Apr 20 13:24:13 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 112.0.1

  * Fix a bug where cookie dates appear to be set in the far

    future after updating Firefox. This may have caused cookies to

    be unintentionally purged (bmo#1827669)

-------------------------------------------------------------------

Mon Apr 10 21:58:19 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 112.0

  * https://www.mozilla.org/en-US/firefox/112.0/releasenotes/

  MFSA 2023-13 (bsc#1210212)

  * CVE-2023-29531 (bmo#1794292)

    Out-of-bound memory access in WebGL on macOS

  * CVE-2023-29532 (bmo#1806394)

    Mozilla Maintenance Service Write-lock bypass

  * CVE-2023-29533 (bmo#1798219, bmo#1814597)

    Fullscreen notification obscured

  * CVE-2023-29534 (bmo#1816007, bmo#1816059, bmo#1821155, bmo#1821576,

    bmo#1821906, bmo#1822298, bmo#1822305)

    Fullscreen notification could have been obscured on Firefox

    for Android

  * MFSA-TMP-2023-0001 (bmo#1819244)

    Double-free in libwebp

  * CVE-2023-29535 (bmo#1820543)

    Potential Memory Corruption following Garbage Collector compaction

  * CVE-2023-29536 (bmo#1821959)

    Invalid free from JavaScript code

  * CVE-2023-29537 (bmo#1823365, bmo#1824200, bmo#1825569)

    Data Races in font initialization code

  * CVE-2023-29538 (bmo#1685403)

    Directory information could have been leaked to WebExtensions

  * CVE-2023-29539 (bmo#1784348)

    Content-Disposition filename truncation leads to Reflected

    File Download

  * CVE-2023-29540 (bmo#1790542)

    Iframe sandbox bypass using redirects and sourceMappingUrls

  * CVE-2023-29541 (bmo#1810191)

    Files with malicious extensions could have been downloaded

    unsafely on Linux

  * CVE-2023-29542 (bmo#1810793, bmo#1815062)

    Bypass of file download extension restrictions

  * CVE-2023-29543 (bmo#1816158)

    Use-after-free in debugging APIs

  * CVE-2023-29544 (bmo#1818781)

    Memory Corruption in garbage collector

  * CVE-2023-29545 (bmo#1823077)

    Windows Save As dialog resolved environment variables

  * CVE-2023-29546 (bmo#1780842)

    Screen recording in Private Browsing included address bar on

    Android

  * CVE-2023-29547 (bmo#1783536)

    Secure document cookie could be spoofed with insecure cookie

  * CVE-2023-29548 (bmo#1822754)

    Incorrect optimization result on ARM64

  * CVE-2023-29549 (bmo#1823042)

    Javascript's bind function may have failed

  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498, bmo#1814217,

    bmo#1818357, bmo#1818762, bmo#1819493, bmo#1820389, bmo#1820602,

    bmo#1821448, bmo#1822413, bmo#1824828)

    Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

  * CVE-2023-29551 (bmo#1763625, bmo#1814314, bmo#1815798, bmo#1815890,

    bmo#1819239, bmo#1819465, bmo#1819486, bmo#1819492, bmo#1819957,

    bmo#1820514, bmo#1820776, bmo#1821838, bmo#1822175, bmo#1823547)

    Memory safety bugs fixed in Firefox 112

- requires

  * NSS 3.89

  * Python >= 3.7 (for build)

- removed obsolete mozilla-bmo1807652.patch

- Fix Icons displayed incorrectly on GNOME/wayland via WMCLASS

  in desktop file

-------------------------------------------------------------------

Mon Mar 27 15:17:17 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 111.0.1 (boo#1209688)

  * Fixed a crash on macOS while pinch-zooming under some circumstances

    (bmo#1658986)

  * Fixed a bug causing Firefox to freeze on startup for some

    Windows users (bmo#1823159)

- fix build on Tumbleweed (mozilla-bmo1807652.patch)

- exclude i586/i686 once again because it fails to link libxul due

  to its size