-------------------------------------------------------------------

Sat Jan 26 22:37:01 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 65.0

  * Enhanced tracking protection

  * allow switching of UI locales within preferences

  * support for the WebP image format

  * "top"-like about:performance

  MFSA 2019-01 (bsc#1122983)

  * CVE-2018-18500 bmo#1510114

    Use-after-free parsing HTML5 stream

  * CVE-2018-18503 bmo#1509442

    Memory corruption with Audio Buffer

  * CVE-2018-18504 bmo#1496413

    Memory corruption and out-of-bounds read of texture client

  * CVE-2018-18505 bmo#1497749

    Privilege escalation through IPC channel messages

  * CVE-2018-18506 bmo#1503393

    Proxy Auto-Configuration file can define localhost access to be proxied

  * CVE-2018-18502 bmo#1499426 bmo#1480090 bmo#1472990 bmo#1514762

    bmo#1501482 bmo#1505887 bmo#1508102 bmo#1508618 bmo#1511580

    bmo#1493497 bmo#1510145 bmo#1516289 bmo#1506798 bmo#1512758

    Memory safety bugs fixed in Firefox 65

  * CVE-2018-18501 bmo#1512450 bmo#1517542 bmo#1513201 bmo#1460619

    bmo#1502871 bmo#1516738 bmo#1516514

    Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

- requires

  NSS 3.41

  rust/carge 1.30

  rust-cbindgen 0.6.7

-------------------------------------------------------------------

Tue Jan 15 14:32:03 UTC 2019 - Martin Liška <mliska@suse.cz>

- Increase disk constraint.

-------------------------------------------------------------------

Mon Jan 14 12:12:12 UTC 2019 - Martin Liška <mliska@suse.cz>

- Remove -v from mach build in order to work-around bmo#1500436.

-------------------------------------------------------------------

Fri Jan 11 15:07:14 UTC 2019 - Martin Liška <mliska@suse.cz>

- Set %clang_build to false on all architectures

- Do not use -fno-delete-null-pointer-checks and -fno-strict-aliasing:

  it should not be needed anymore

- Do not overwrite enable-optimize and when possible

  enable --enable-debug-symbols.

- Add -v to mach in order to make build verbose.

-------------------------------------------------------------------

Wed Jan  9 22:40:14 UTC 2019 - astieger@suse.com

- Mozilla Firefox 64.0.2:

  * Update the Japanese translation for missing strings (bmo#1513259)

  * Properly restore column sizes in developer tools inspector (bmo#1503175)

  * Fixed video stuttering on Youtube (bmo#1513511)

  * Fix updates for some lightweight themes (bmo#1508777)

-------------------------------------------------------------------

Tue Dec 18 14:46:41 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Enable build_hardened for all architectures

- Switch back aarch64 to clang as '-fPIC' fixes bmo#1513605

- Remove obolete '--enable-pie' as -pie is always enabled for

  gcc and clang

-------------------------------------------------------------------

Wed Dec 12 17:33:29 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Switch aarch64 builds back to gcc, not clang (bmo#1513605)

- Switch %arm builds back to gcc, not clang to avoid OOM

- Fix build flags when clang is not used

- Fix flags for clang ppc64 builds

-------------------------------------------------------------------

Tue Dec 11 08:45:56 UTC 2018 - Wolfgang Rosenauer <wr@rosenauer.org>

- update to Firefox 64.0

  * Better recommendations: You may see suggestions in regular browsing

    mode for new and relevant Firefox features, services, and extensions

    based on how you use the web (for US users only)

  * Enhanced tab management: You can now select multiple tabs from the

    tab bar and close, move, bookmark, or pin them quickly and easily

  * Easier performance management: The new Task Manager page found at

    about:performance lets you see how much energy each open tab consumes

    and provides access to close tabs to conserve power

  * Improved performance for Mac and Linux users, by enabling link time

    optimization (Clang LTO).

  * Added option to remove add-ons using the context menu on their

    toolbar buttons

  * RSS feed preview and live bookmarks are available only via add-ons

  * TLS certificates issued by Symantec are no longer trusted by Firefox.

    Website operators are strongly encouraged to replace any remaining

    Symantec TLS certificates as soon as possible

  MFSA 2018-29 (bsc#1119105)

  * CVE-2018-12407 bmo#1505973

    Buffer overflow with ANGLE library when using VertexBuffer11 module

  * CVE-2018-17466 bmo#1488295

    Buffer overflow and out-of-bounds read in ANGLE library with

    TextureStorage11

  * CVE-2018-18492 bmo#1499861

    Use-after-free with select element

  * CVE-2018-18493 bmo#1504452

    Buffer overflow in accelerated 2D canvas with Skia

  * CVE-2018-18494 bmo#1487964

    Same-origin policy violation using location attribute and

    performance.getEntries to steal cross-origin URLs

  * CVE-2018-18495 bmo#1427585

    WebExtension content scripts can be loaded in about: pages

  * CVE-2018-18496 bmo#1422231 (Windows only)

    Embedded feed preview page can be abused for clickjacking

  * CVE-2018-18497 bmo#1488180

    WebExtensions can load arbitrary URLs through pipe separators

  * CVE-2018-18498 bmo#1500011

    Integer overflow when calculating buffer sizes for images

  * CVE-2018-12406 bmo#1456947 bmo#1475669 bmo#1504816 bmo#1502886

    bmo#1500064 bmo#1500310 bmo#1500696 bmo#1498765 bmo#1499198 bmo#1434490

    bmo#1481745 bmo#1458129

    Memory safety bugs fixed in Firefox 64

  * CVE-2018-12405 bmo#1494752 bmo#1503326 bmo#1505181 bmo#1500759

    bmo#1504365 bmo#1506640 bmo#1503082 bmo#1502013 bmo#1510471

    Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4

- requires

  * rust/cargo >= 1.29

  * mozilla-nss >= 3.40.1

  * rust-cbindgen >= 0.6.4

- rebased patches

- removed obsolete patch

  * mozilla-bmo1491289.patch

- now uses clang primarily for compilation

-------------------------------------------------------------------

Wed Nov 28 11:07:18 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Remove --disable-elf-hack when not available: on aarch64 and ppc64*

-------------------------------------------------------------------

Mon Nov 26 09:46:02 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Clean-up %arm build

-------------------------------------------------------------------

Sun Nov 18 11:01:21 UTC 2018 - manfred.h@gmx.net

- update to Firefox 63.0.3

  * Games using WebGL (created in Unity) get stuck after very short

    time of gameplay (bmo#1502748)

  * Slow page loading for some users with specific proxy configurations

    (bmo#1495024)

  * Disable HTTP response throttling by default for causing bugs with

    videos in background tabs (bmo#1503354)

  * Opening magnet links no longer works (bmo#1498934)

  * Crash fixes (bmo#1498510, bmo#1503424)

- removed mozilla-newer-cbindgen.patch; no longer needed

-------------------------------------------------------------------

Thu Nov  8 14:59:13 UTC 2018 - wr@rosenauer.org

- update to Firefox 63.0.1

  * Snippets are not loaded due to missing element (bmo#1503047)

  * Print preview always shows 30& scale when it is actually

    Shrink To Fit (bmo#1501952)

  * Dialog displayed when closing multiple windows shows unreplaced

    %1$S placeholder in Japanese and potentially other locales

    (bmo#1500823)

-------------------------------------------------------------------

Mon Oct 29 14:07:51 UTC 2018 - wr@rosenauer.org

- update to Firefox 63.0

  * WebExtensions now run in their own process on Linux

  * The Ctrl+Tab shortcut now displays thumbnail previews of your

    tabs and cycles through tabs in recently used order. This new

    default behavior is activated only in new profiles and can be

    changed in preferences.

  * Added support for Web Components custom elements and shadow DOM

  MFSA 2018-26 (bsc#1112852)

  * CVE-2018-12391 (bmo#1478843) (Android-only)

    HTTP Live Stream audio data is accessible cross-origin

  * CVE-2018-12392 (bmo#1492823)

    Crash with nested event loops

  * CVE-2018-12393 (bmo#1495011) (only affects non-64-bit archs)

    Integer overflow during Unicode conversion while loading JavaScript

  * CVE-2018-12395 (bmo#1467523)

    WebExtension bypass of domain restrictions through header rewriting

  * CVE-2018-12396 (bmo#1483602)

    WebExtension content scripts can execute in disallowed contexts

  * CVE-2018-12397 (bmo#1487478)

    Missing warning prompt when WebExtension requests local file access

  * CVE-2018-12398 (bmo#1460538, bmo#1488061)

    CSP bypass through stylesheet injection in resource URIs

  * CVE-2018-12399 (bmo#1490276)

    Spoofing of protocol registration notification bar

  * CVE-2018-12400 (bmo#1448305) (Android only)

    Favicons are cached in private browsing mode on Firefox for Android

  * CVE-2018-12401 (bmo#1422456)

    DOS attack through special resource URI parsing

  * CVE-2018-12402 (bmo#1469916)

    SameSite cookies leak when pages are explicitly saved

  * CVE-2018-12403 (bmo#1484753)

    Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP

  * CVE-2018-12388 (bmo#1472639, bmo#1485698, bmo#1301547, bmo#1471427,

    bmo#1379411, bmo#1482122, bmo#1486314, bmo#1487167)

    Memory safety bugs fixed in Firefox 63

  * CVE-2018-12390 (bmo#1487098, bmo#1487660, bmo#1490234, bmo#1496159,

    bmo#1443748, bmo#1496340, bmo#1483905, bmo#1493347, bmo#1488803,

    bmo#1498701, bmo#1498482, bmo#1442010, bmo#1495245, bmo#1483699,

    bmo#1469486, bmo#1484905, bmo#1490561, bmo#1492524, bmo#1481844)

    Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3

- requires NSPR 4.20, NSS 3.39 and Rust 1.28

- latest rust does not provide rust-std so stop requiring it

- requires rust-cbindgen >= 0.6.2 to build

- requires nodejs >= 8.11 to build

- added mozilla-bmo1491289.patch to fix system NSS build (bmo#1491289)

- added mozilla-cubeb-noreturn.patch to fix non-return function

- added mozilla-newer-cbindgen.patch to fix build with cbindgen 0.6.7

- disable elfhack for TW and newer due to build errors

- removed obsolete patches

  * mozilla-no-return.patch

  * mozilla-no-stdcxx-check.patch

-------------------------------------------------------------------

Thu Oct 25 14:39:04 UTC 2018 - guillaume.gardet@opensuse.org

- Update _constraints for armv6/7

-------------------------------------------------------------------

Thu Oct 25 08:50:24 UTC 2018 - guillaume.gardet@opensuse.org

- Add patch to fix build on armv7:

  * mozilla-bmo1463035.patch

-------------------------------------------------------------------

Tue Oct  2 21:28:31 UTC 2018 - astieger@suse.com

- Mozilla Firefox 62.0.3:

  MFSA 2018-24

  * CVE-2018-12386 (bsc#1110506, bmo#1493900)

    Type confusion in JavaScript allowed remote code execution

  * CVE-2018-12387 (bsc#1110507, bmo#1493903)

    Array.prototype.push stack pointer vulnerability may enable

    exploits in the sandboxed content process

-------------------------------------------------------------------

Sat Sep 22 09:03:53 UTC 2018 - astieger@suse.com

- Mozilla Firefox 62.0.2:

  MFSA 2018-22

  * CVE-2018-12385 (boo#1109363, bmo#1490585)

    Crash in TransportSecurityInfo due to cached data

  * Unvisited bookmarks can once again be autofilled in the address

    bar

  * Fix WebGL rendering issues

  * Fix fallback on startup when a language pack is missing

  * Avoid crash when sharing a profile with newer (as yet

    unreleased) versions of Firefox

  * Do not undo removal of search engines when using a language

    pack

  * Fixed rendering of some web sites

  * Restored compatibility with some sites using deprecated TLS

    settings

- disable rust debug symbols to fix build on %ix86

-------------------------------------------------------------------

Mon Sep  3 10:47:43 UTC 2018 - wr@rosenauer.org

- update to Firefox 62.0

  * Firefox Home (the default New Tab) now allows users to display

    up to 4 rows of top sites, Pocket stories, and highlights

  * "Reopen in Container" tab menu option appears for users with

    Containers that lets them choose to reopen a tab in a different

    container

  * In advance of removing all trust for Symantec-issued certificates

    in Firefox 63, a preference was added that allows users to distrust

    certificates issued by Symantec. To use this preference, go to

    about:config in the address bar and set the preference

    "security.pki.distrust_ca_policy" to 2.

  * Support for CSS Shapes, allowing for richer web page layouts.

    This goes hand in hand with a brand new Shape Path Editor in the

    CSS inspector.

  * CSS Variable Fonts (OpenType Font Variations) support, which makes

    it possible to create beautiful typography with a single font file

  * Added Canadian English (en-CA) locale

  MFSA 2018-20 (bsc#1107343)

  * CVE-2018-12377 (bmo#1470260)

    Use-after-free in refresh driver timers

  * CVE-2018-12378 (bmo#1459383)

    Use-after-free in IndexedDB

  * CVE-2018-12379 (bmo#1473113) (updater is disabled for us)

    Out-of-bounds write with malicious MAR file

  * CVE-2017-16541 (bmo#1412081)

    Proxy bypass using automount and autofs

  * CVE-2018-12381 (bmo#1435319)

    Dragging and dropping Outlook email message results in page navigation

  * CVE-2018-12382 (bmo#1479311) (Android only)

    Addressbar spoofing with javascript URI on Firefox for Android

  * CVE-2018-12383 (bmo#1475775)

    Setting a master password post-Firefox 58 does not delete

    unencrypted previously stored passwords

  * CVE-2018-12375

    Memory safety bugs fixed in Firefox 62

  * CVE-2018-12376

    Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2

- requires NSS >= 3.38

- removed obsolete patch

  mozilla-bmo1464766.patch

-------------------------------------------------------------------

Thu Aug  9 14:22:00 UTC 2018 - wr@rosenauer.org

- update to Firefox 61.0.2

  * Improved website rendering with the Retained Display List feature

    enabled (bmo#1474402)

  * Fixed broken DevTools panels with certain extensions installed

    (bmo#1474379)

  * Fixed a crash for users with some accessibility tools enabled

    (bmo#1474007)

-------------------------------------------------------------------

Mon Jul  9 07:22:09 UTC 2018 - astieger@suse.com

- Mozilla Firefox 61.0.1:

  * Fix missing content on the New Tab Page and the Home section of

    the Preferences page (bmo#1471375)

  * Fixed loss of bookmarks under rare circumstances when upgrading

    from Firefox 60 (bmo#1472127)

  * Improved playback of Twitch 1080p video streams (bmo#1469257)

  * Web pages no longer lose focus when a browser popup window is

    opened (bmo#1471415)

  * Re-allowed downloading files from FTP sites via the "Save Link

    As" option when linked from HTTP pages (bmo#1470295)

  * Fixed extensions being unable to override the default homepage

    in certain situations (bmo#1466846)

-------------------------------------------------------------------

Sat Jun 23 07:25:51 UTC 2018 - wr@rosenauer.org

- update to Firefox 61.0

  * Performance enhancements

  * Various improvements for dark theme support will provide a more

    consistent experience across the entire Firefox UI

  * OpenSearch plugins offered by web pages can now be added from the

    page action menu for easier installation

  * Improved support for allowing WebExtensions to manage and hide tabs

  MFSA 2018-15 (bsc#1098998)

  * CVE-2018-12359 (bmo#1459162)

    Buffer overflow using computed size of canvas element

  * CVE-2018-12360 (bmo#1459693)

    Use-after-free when using focus()

  * CVE-2018-12361 (bmo#1463244)

    Integer overflow in SwizzleData

  * CVE-2018-12358 (bmo#1467852)

    Same-origin bypass using service worker and redirection

  * CVE-2018-12362 (bmo#1452375)

    Integer overflow in SSSE3 scaler

  * CVE-2018-5156 (bmo#1453127)

    Media recorder segmentation fault when track type is changed during capture

  * CVE-2018-12363 (bmo#1464784)

    Use-after-free when appending DOM nodes

  * CVE-2018-12364 (bmo#1436241)

    CSRF attacks through 307 redirects and NPAPI plugins

  * CVE-2018-12365 (bmo#1459206)

    Compromised IPC child process can list local filenames

  * CVE-2018-12371 (bmo#1465686) 

    Integer overflow in Skia library during edge builder allocation

  * CVE-2018-12366 (bmo#1464039)

    Invalid data handling during QCMS transformations

  * CVE-2018-12367 (bmo#1462891)

    Timing attack mitigation of PerformanceNavigationTiming

  * CVE-2018-12369 (bmo#1454909)

    WebExtension security permission checks bypassed by embedded experiments

  * CVE-2018-12370 (bmo#1456652)

    SameSite cookie protections bypassed when exiting Reader View

  * CVE-2018-5186 (bmo#1464872,bmo#1463329,bmo#1419373,bmo#1412882,

    bmo#1413033,bmo#1444673,bmo#1454448,bmo#1453505,bmo#1438671)

    Memory safety bugs fixed in Firefox 61

  * CVE-2018-5187 (bmo#1461324,bmo#1414829,bmo#1395246,bmo#1467938,

    bmo#1461619,bmo#1425930,bmo#1438556,bmo#1454285,bmo#1459568,

    bmo#1463884)

    Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1

  * CVE-2018-5188 (bmo#1456189,bmo#1456975,bmo#1465898,bmo#1392739,

    bmo#1451297,bmo#1464063,bmo#1437842,bmo#1442722,bmo#1452576,

    bmo#1450688,bmo#1458264,bmo#1458270,bmo#1465108,bmo#1464829,

    bmo#1464079,bmo#1463494,bmo#1458048)

    Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9

- requires NSS 3.37.3

- requires python >= 3.5 to build

- removed obsolete patches

  mozilla-i586-DecoderDoctorLogger.patch

  mozilla-i586-domPrefs.patch

  mozilla-fix-skia-aarch64.patch

  mozilla-bmo1375074.patch

  mozilla-enable-csd.patch

- patch for new no-return warnings (mozilla-no-return.patch)

- do not disable system installed locales (mozilla-bmo1464766.patch)

-------------------------------------------------------------------

Fri Jun  8 10:52:13 UTC 2018 - bjorn.lie@gmail.com

- Add conditional for pkgconfig(gconf-2.0) BuildRequires, and pass

  conditional --disable-gconf to configure: no longer pull in

  obsolete gconf2 for Tumbleweed.

-------------------------------------------------------------------

Thu Jun  7 12:11:06 UTC 2018 - wr@rosenauer.org

- update to Firefox 60.0.2

  * requires NSS 3.36.4

  MFSA 2018-14 (bsc#1096449)

  * CVE-2018-6126 (bmo#1462682)

    Heap buffer overflow rasterizing paths in SVG with Skia

-------------------------------------------------------------------

Wed Jun  6 18:57:52 UTC 2018 - guillaume.gardet@opensuse.org

- Add upstream patch to fix boo#1093059 instead of '-ffixed-x28'

  workaround:

  * mozilla-bmo1375074.patch

-------------------------------------------------------------------

Sat May 26 15:53:25 UTC 2018 - wr@rosenauer.org

- fixed "open with" option under KDE (boo#1094747)

- workaround crash on startup on aarch64 (boo#1093059)

  (contributed by guillaume.gardet@arm.com)

-------------------------------------------------------------------

Wed May 23 08:49:09 UTC 2018 - guillaume.gardet@opensuse.org

- Disable webrtc for aarch64 due to bmo#1434589

- Add patch to fix skia build on AArch64:

  * mozilla-fix-skia-aarch64.patch

-------------------------------------------------------------------

Thu May 17 14:01:18 UTC 2018 - wr@rosenauer.org

- update to Firefox 60.0.1

  * Avoid overly long cycle collector pauses with some add-ons installed

    (bmo#1449033)

  * After unckecking the "Sponsored Stories" option, the New Tab page

    now immediately stops displaying "Sponsored content" cards (bmo#1458906)

  * On touchscreen devices, fixed momentum scrolling on non-zoomable pages

    (bmo#1457743)

  * Use the right default background when opening tabs or windows in

    high contrast mode (bmo#1458956)

  * Restored translations of the Preferences panels when using a

    language pack (bmo#1461590)

-------------------------------------------------------------------

Mon May 14 13:37:38 UTC 2018 - pcerny@suse.com

- parellelise locales building

-------------------------------------------------------------------

Mon May  7 08:32:28 UTC 2018 - wr@rosenauer.org