-------------------------------------------------------------------

Tue Dec 28 17:45:28 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Add upstream patches:

  * mozilla-bmo1745560.patch: Fix build against wayland 1.20.

  * mozilla-bmo1744896.patch: Create WaylandVsyncSource on window

    creation

-------------------------------------------------------------------

Mon Dec 20 21:57:30 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.2

  * Addresses frequent crashes experienced by users with C/E/Z-Series

    "Bobcat" CPUs running on Windows 7, 8, and 8.1.

- updated constraints for ppc and x86-64

-------------------------------------------------------------------

Fri Dec 17 13:49:16 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.1 (bsc#1193845)

  * Fixed frequent

    MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING error

    messages when trying to connect to various microsoft.com

    domains (bmo#1745600)

  * Fix for a WebRender crash on some Linux/X11 systems (bmo#1741956)

  * Fix for a frequent Windows shutdown crash (bmo#1738984)

  * Fix websites contrast issues for some Linux users with

    Dark mode set at OS level (bmo#1740518)

-------------------------------------------------------------------

Sat Dec  4 12:07:21 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0

  * You can now move the Picture-in-Picture toggle button to the

    opposite side of the video. Simply look for the new context menu

    option Move Picture-in-Picture Toggle to Left (Right) Side.

  * To better protect Firefox users against side-channel attacks such

    as Spectre, Site Isolation is now enabled for all Firefox 95 users.

  * https://www.mozilla.org/en-US/firefox/95.0/releasenotes

  MFSA 2021-52 (bsc#1193485)

  * CVE-2021-43536 (bmo#1730120)

    URL leakage when navigating while executing asynchronous

    function

  * CVE-2021-43537 (bmo#1738237)

    Heap buffer overflow when using structured clone

  * CVE-2021-43538 (bmo#1739091)

    Missing fullscreen and pointer lock notification when

    requesting both

  * CVE-2021-43539 (bmo#1739683)

    GC rooting failure when calling wasm instance methods

  * MOZ-2021-0010 (bmo#1735852)

    Use-after-free in fullscreen objects on MacOS

  * CVE-2021-43540 (bmo#1636629)

    WebExtensions could have installed persistent ServiceWorkers

  * CVE-2021-43541 (bmo#1696685)

    External protocol handler parameters were unescaped

  * CVE-2021-43542 (bmo#1723281)

    XMLHttpRequest error codes could have leaked the existence of

    an external protocol handler

  * CVE-2021-43543 (bmo#1738418)

    Bypass of CSP sandbox directive when embedding

  * CVE-2021-43544 (bmo#1739934)

    Receiving a malicious URL as text through a SEND intent could

    have led to XSS

  * CVE-2021-43545 (bmo#1720926)

    Denial of Service when using the Location API in a loop

  * CVE-2021-43546 (bmo#1737751)

    Cursor spoofing could overlay user interface when native

    cursor is zoomed

  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,

    bmo#1737009, bmo#1739372, bmo#1739421)

    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4

- requires

  NSS >= 3.72

-------------------------------------------------------------------

Thu Dec  2 20:32:42 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- remove x-scheme-handler/ftp from firefox.desktop boo#1193321

-------------------------------------------------------------------

Thu Nov 25 20:21:07 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Drop unused libidl-devel BuildRequires.

-------------------------------------------------------------------

Tue Nov 23 22:00:38 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.2:

  * Update preference design for Firefox Suggest for improved clarity

  * Resolved general instability/crashes on Linux caused by a file

    descriptor leak when backgrounding tabs using WebGL

    (bmo#1741997)

-------------------------------------------------------------------

Fri Nov  5 18:02:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.1:

  * fixes for other platforms

-------------------------------------------------------------------

Sat Oct 30 07:52:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 94.0

  * https://www.mozilla.org/en-US/firefox/94.0/releasenotes

  MFSA 2021-48 (bsc#1192250)

  * CVE-2021-38503 (bmo#1729517)

    iframe sandbox rules did not apply to XSLT stylesheets

  * CVE-2021-38504 (bmo#1730156)

    Use-after-free in file picker dialog

  * CVE-2021-38505 (bmo#1730194)

    Windows 10 Cloud Clipboard may have recorded sensitive user data

  * CVE-2021-38506 (bmo#1730750)

    Firefox could be coaxed into going into fullscreen mode

    without notification or warning

  * CVE-2021-38507 (bmo#1730935)

    Opportunistic Encryption in HTTP2 could be used to bypass the

    Same-Origin-Policy on services hosted on other ports

  * MOZ-2021-0003 (bmo#1736886)

    Universal XSS in Firefox for Android via QR Code URLs

  * CVE-2021-38508 (bmo#1366818)

    Permission Prompt could be overlaid, resulting in user

    confusion and potential spoofing

  * MOZ-2021-0004 (bmo#1659155)

    Web Extensions could access pre-redirect URL when their

    context menu was triggered by a user

  * CVE-2021-38509 (bmo#1718571)

    Javascript alert box could have been spoofed onto an

    arbitrary domain

  * CVE-2021-38510 (bmo#1731779)

    Download Protections were bypassed by .inetloc files on Mac OS

  * MOZ-2021-0005 (bmo#1719203)

    'Copy Image Link' context menu action could have been abused

    to see authentication tokens

  * MOZ-2021-0006 (bmo#1724233)

    URL Parsing may incorrectly parse internationalized domains

  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048, bmo#1735152)

    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

- removed obsolete patches

  * mozilla-bmo1602730.patch

  * mozilla-bmo1725828.patch

  * mozilla-bmo1729124.patch

- requires

  NSS >= 3.71

  rust >= 1.53

- fix Plasma detection (boo#1191825)

- fix Link error "undefined hidden symbol:"

  https://github.com/openSUSE/firefox-maintenance/issues/37

-------------------------------------------------------------------

Tue Oct 26 19:48:24 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires

- (re-)enable LTO on Tumbleweed

-------------------------------------------------------------------

Wed Oct 20 06:49:52 UTC 2021 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Rebase mozilla-sandbox-fips.patch to punch another hole in the

  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled

  from within the newly introduced socket process sandbox.

  This fixes bsc#1191815 and bsc#1190141

-------------------------------------------------------------------

Mon Oct 18 12:44:44 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix build on aarch64 (bmo#1729124)

  * mozilla-bmo1729124.patch

-------------------------------------------------------------------

Fri Oct  1 18:33:33 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 93.0

  * supports the new AVIF image format

  * PDF viewer now supports filling more forms (XFA-based forms)

  * now blocks downloads that rely on insecure connections,

    protecting against potentially malicious or unsafe downloads

  * Improved web compatibility for privacy protections with SmartBlock 3.0

  * Introducing a new referrer tracking protection in Strict Tracking

    Protection and Private Browsing

  * TLS ciphersuites that use 3DES have been disabled. Such

    ciphersuites can only be enabled when deprecated versions of

    TLS are also enabled

  * The download panel now follows the Firefox visual styles

  MFSA 2021-43 (bsc#1191332)

  * CVE-2021-38496 (bmo#1725335)

    Use-after-free in MessageTask

  * CVE-2021-38497 (bmo#1726621)

    Validation message could have been overlaid on another origin

  * CVE-2021-38498 (bmo#1729642)

    Use-after-free of nsLanguageAtomService object

  * CVE-2021-32810 (bmo#1729813)

    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)

    Data race in crossbeam-deque

  * CVE-2021-38500 (bmo#1725854, bmo#1728321)

    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,

    and Firefox ESR 91.2

  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)

    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2

  * CVE-2021-38499 (bmo#1667102, bmo#1723170, bmo#1725356, bmo#1727364)

    Memory safety bugs fixed in Firefox 93

- removed obsolete mozilla-bmo1708709.patch

- require NSS >= 3.70

- allow to override wayland detection by defining MOZ_ENABLE_WAYLAND

  explicitely as 0 or 1

- fix aarch64 build by updating constraints

- add mozilla-bmo1725828.patch to fix widevine (bsc#1190842)

- add mozilla-bmo531915.patch to fix build for i586

-------------------------------------------------------------------

Sat Sep 25 10:10:56 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 92.0.1

  * Fixed: Fixes an issue where audio playback was not working on

    some Linux systems (bmo#1730499)

  * Fixed: Fixes issues with the findbar close button on

    different operating systems (bmo#1728368)

-------------------------------------------------------------------

Mon Sep  6 10:16:28 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 92.0

  * More secure connections: Firefox can now automatically upgrade to

    HTTPS using HTTPS RR as Alt-Svc headers

  * Full-range color levels are now supported for video playback on

    many systems

  MFSA 2021-38 (bsc#1190269)

  * CVE-2021-29993 (bmo#1708544, bmo#1708767, bmo#1712240,

    bmo#1712242, bmo#1729259)

    Handling custom intents could lead to crashes and UI spoofs

  * CVE-2021-38491 (bmo#1551886)

    Mixed-Content-Blocking was unable to check opaque origins

  * CVE-2021-38492 (bmo#1721107)

    Navigating to `mk:` URL scheme could load Internet Explorer

  * CVE-2021-38493 (bmo#1723391, bmo#1724101, bmo#1724107)

    Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and

    Firefox ESR 91.1

  * CVE-2021-38494 (bmo#1723920, bmo#1725638)

    Memory safety bugs fixed in Firefox 92

- updated appdata

- remove mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch

  (does not apply anymore; unclear if obsolete)

- bring back mozilla-silence-no-return-type.patch and

  run post-build-checks everywhere again

- requires NSS 3.69.1

-------------------------------------------------------------------

Tue Aug 31 00:33:39 UTC 2021 - Atri Bhattacharya <badshah400@gmail.com>

- Add mozilla-bmo1708709.patch: On [wayland] popup can be wrongly

  repositioned due to rounding errors when font scaling != 1

  (bmo#1708709); patch taken from upstream bug report and rebased

  to apply cleanly against current version.

-------------------------------------------------------------------

Sun Aug 29 14:45:29 UTC 2021 - Martin Liška <mliska@suse.cz>

- Bump using with GCC (tested locally).

-------------------------------------------------------------------

Fri Aug 27 22:47:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 91.0.2:

  * Fixed: Firefox no longer clears authentication data when

    purging trackers, to avoid repeatedly prompting for a

    password (bmo#1721084)

-------------------------------------------------------------------

Wed Aug 18 06:34:01 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 91.0.1

  * Fixed an issue causing buttons on the tab bar to be resized when

    loading certain websites (bmo#1704404)

  * Fixed an issue which caused tabs from private windows to be

    visible in non-private windows when viewing switch-to-tab results

    in the address bar panel (bmo#1720369)

  * Various stability fixes

  MFSA 2021-37 (bsc#1189547)

  * CVE-2021-29991 (bmo#1724896)

    Header Splitting possible with HTTP/3 Responses

-------------------------------------------------------------------

Mon Aug  9 14:55:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 91.0

  MFSA 2021-33 (bsc#1188891)

  * CVE-2021-29986 (bmo#1696138)

    Race condition when resolving DNS names could have led to

    memory corruption

  * CVE-2021-29981 (bmo#1707774)

    Live range splitting could have led to conflicting

    assignments in the JIT

  * CVE-2021-29988 (bmo#1717922)

    Memory corruption as a result of incorrect style treatment

  * CVE-2021-29983 (bmo#1719088)

    Firefox for Android could get stuck in fullscreen mode

  * CVE-2021-29984 (bmo#1720031)

    Incorrect instruction reordering during JIT optimization

  * CVE-2021-29980 (bmo#1722204)

    Uninitialized memory in a canvas object could have led to

    memory corruption

  * CVE-2021-29987 (bmo#1716129)

    Users could have been tricked into accepting unwanted

    permissions on Linux

  * CVE-2021-29985 (bmo#1722083)

    Use-after-free media channels

  * CVE-2021-29982 (bmo#1715318)

    Single bit data leak due to incorrect JIT optimization and

    type confusion

  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,

    bmo#1719998, bmo#1720568)

    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13

  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,

    bmo#1719319, bmo#1722073)

    Memory safety bugs fixed in Firefox 91

- requires

  * rustc/cargo >= 1.51

  * NSPR >= 4.32

  * NSS >= 3.68

- force-disable webrender on BE platforms

-------------------------------------------------------------------

Sat Jul 24 07:15:54 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 90.0.2:

  * Changed: Updates to support DoH Canada rollout (bmo#1713036)

  * Fixed: Fixed truncated output when printing (bmo#1720621)

  * Fixed: Fixed menu styling on some Gtk themes (bmo#1720441,

    bmo#1720874)

-------------------------------------------------------------------

Mon Jul 19 20:08:56 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 90.0.1 (boo#1188480):

  * Fixed: Fixed busy looping processing some HTTP3 responses

    (bmo#1720079)

  * Fixed: Fixed transient errors authenticating with some smart

    cards (bmo#1715325)

  * Fixed: Fixed a rare crash on shutdown (bmo#1707057)

  * Fixed: Fixed a race on startup that caused about:support to

    end up empty after upgrade (bmo#1717894, boo#1188330)

-------------------------------------------------------------------

Sun Jul 11 08:53:02 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 90.0

  MFSA 2021-28 (bsc#1188275)

  * CVE-2021-29970 (bmo#1709976)

    Use-after-free in accessibility features of a document

  * CVE-2021-29971 (bmo#1713638)

    Granted permissions only compared host; omitting scheme and

    port on Android

  * CVE-2021-30547 (bmo#1715766)

    Out of bounds write in ANGLE

  * CVE-2021-29972 (bmo#1696816)

    Use of out-of-date library included use-after-free

    vulnerability

  * CVE-2021-29973 (bmo#1701932)

    Password autofill on HTTP websites was enabled without user

    interaction on Android

  * CVE-2021-29974 (bmo#1704843)

    HSTS errors could be overridden when network partitioning was

    enabled

  * CVE-2021-29975 (bmo#1713259)

    Text message could be overlaid on top of another website

  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,

    bmo#1711576, bmo#1714391)

    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12

  * CVE-2021-29977 (bmo#1665836, bmo#1686138, bmo#1704316,

    bmo#1706314, bmo#1709931, bmo#1712084, bmo#1712357,

    bmo#1714066)

    Memory safety bugs fixed in Firefox 90

- requires

  NSPR 4.31

  NSS 3.66

- Gtk2 support removed (was only for Flash plugin before)

-------------------------------------------------------------------

Wed Jun 23 16:54:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 89.0.2 (boo#1187648):

  * Fix occasional hangs with Software WebRender on Linux (bmo#1708224)

-------------------------------------------------------------------

Sat Jun 19 09:00:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 89.0.1 (boo#1187475):

  * Updated translations, including full Spanish (Mexico)

    localization and other improvements (bmo#1714946)

  * Fix various font related regressions (bmo#1694174)

  * Linux: Fix performance and stability regressions with