-------------------------------------------------------------------

Thu Mar 24 21:49:57 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- MozillaFirefox 98.0.2:

  * Fixed: Fixed an issue preventing users from typing in Address

    Bar after opening new tab and pressing cmd + enter

    (bmo#1757376)

  * Fixed: Fixed an issue causing some users to crash in out-of-

    memory conditions (bmo#1757618)

  * Fixed: Fixed an issue in session history which caused some

    sites to fail to load (bmo#1758664)

  * Fixed: Fixed an add-on specific compatibility issue

    (bmo#1759162)

-------------------------------------------------------------------

Wed Mar 23 15:14:22 UTC 2022 - Simon Vogl <simon.vogl@gmx.net>

- Change mozilla-kde.patch to follow the GNOME registry

  behavior for new MIME types to avoid opening downloaded files

  without any inquiries (bsc#1197319)

-------------------------------------------------------------------

Tue Mar 22 12:22:51 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix start-up on aarch64:

  * mozilla-bmo1757571.patch

-------------------------------------------------------------------

Thu Mar 17 14:52:39 UTC 2022 - Dirk Müller <dmueller@suse.com>

-------------------------------------------------------------------

Thu Mar 17 09:18:01 UTC 2022 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,

  faster buildhosts, as the others struggle to build FF.

-------------------------------------------------------------------

Mon Mar 14 22:48:42 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 98.0.1:

  * Yandex and Mail.ru have been removed as optional search

    providers in the drop-down search menu in Firefox

-------------------------------------------------------------------

Tue Mar  8 10:27:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 98.0

  * Firefox has a new optimized download flow

  * other changes as documented here

    https://www.mozilla.org/en-US/firefox/98.0/releasenotes

  MFSA 2022-10 (bsc#1196900)

  * CVE-2022-26383 (bmo#1742421)

    Browser window spoof using fullscreen mode

  * CVE-2022-26384 (bmo#1744352)

    iframe allow-scripts sandbox bypass

  * CVE-2022-26387 (bmo#1752979)

    Time-of-check time-of-use bug when verifying add-on signatures

  * CVE-2022-26381 (bmo#1736243)

    Use-after-free in text reflows

  * CVE-2022-26382 (bmo#1741888)

    Autofill Text could be exfiltrated via side-channel attacks

  * CVE-2022-26385 (bmo#1747526)

    Use-after-free in thread shutdown

  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,

    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,

    bmo#1754508)

    Memory safety bugs fixed in Firefox 98

- requires NSS 3.75

- add mozilla-bmo1756347.patch to fix i586 build

-------------------------------------------------------------------

Fri Feb 18 20:38:22 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 97.0.1

  * Fixed: Fixed an issue where TikTok videos would fail to load

    when selected from a user's profile page (bmo#1750973)

  * Fixed: Fixed an issue which led to Picture-in-Picture mode

    being unable to be toggled on Hulu (bmo#1753401)

  * Fixed: Works around problems with WebRoot SecureAnywhere

    antivirus rendering Firefox unusable in some situations

    (bmo#1752466)

  * Fixed: Fixed an issue causing users to see the Restore

    Session screen unexpectedly when starting Firefox

    (bmo#1749996)

-------------------------------------------------------------------

Mon Feb 14 19:31:29 UTC 2022 - Luciano Santos <luc14n0@opensuse.org>

- Remove bashisms ("source" and "function" keywords) from

  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user

  has either dash-sh package or busybox-sh to handle Bourn Shell

  scripts rather than having bash-sh package, the script would

  fail. Using "." instead of "source" and "create_langpack_link()"

  function definition is enough to keep both sides sane,

  behavior-wise.

-------------------------------------------------------------------

Tue Feb  8 08:40:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 97.0

  MFSA 2022-04 (bsc#1195682)

  * CVE-2022-22753 (bmo#1732435)

    Privilege Escalation to SYSTEM on Windows via Maintenance Service

  * CVE-2022-22754 (bmo#1750565)

    Extensions could have bypassed permission confirmation during update

  * CVE-2022-22755 (bmo#1309630)

    XSL could have allowed JavaScript execution after a tab was closed

  * CVE-2022-22756 (bmo#1317873)

    Drag and dropping an image could have resulted in the dropped

    object being an executable

  * CVE-2022-22757 (bmo#1720098)

    Remote Agent did not prevent local websites from connecting

  * CVE-2022-22758 (bmo#1728742)

    tel: links could have sent USSD codes to the dialer on

    Firefox for Android

  * CVE-2022-22759 (bmo#1739957)

    Sandboxed iframes could have executed script if the parent

    appended elements

  * CVE-2022-22760 (bmo#1740985, bmo#1748503)

    Cross-Origin responses could be distinguished between script

    and non-script content-types

  * CVE-2022-22761 (bmo#1745566)

    frame-ancestors Content Security Policy directive was not

    enforced for framed extension pages

  * CVE-2022-22762 (bmo#1743931)

    JavaScript Dialogs could have been displayed over other

    domains on Firefox for Android

  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,

    bmo#1748210, bmo#1748279)

    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6

  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,

    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,

    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,

    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,

    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,

    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)

    Memory safety bugs fixed in Firefox 97

- requires NSS 3.74

- requires rust 1.57

-------------------------------------------------------------------

Mon Feb  7 22:21:29 UTC 2022 - Dirk Müller <dmueller@suse.com>

- remove memoryperjob and use %limit instead. this allows to

  adapt to more worker types, and lowers the time the package

  is stuck in "scheduling". raising memory above 8 to lower

  risk for LTO jobs to run OOM

- add hack to disable -Wl,--gc-section which avoids a binutils

  segfault on x86

- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere

-------------------------------------------------------------------

Sun Jan 30 23:58:34 UTC 2022 - Dirk Müller <dmueller@suse.com>

- disable ccache, this adds about 1 minute of build time and

  over 2 GB of disk space usage without benefit on OBS builds

- build with rust-simd like upstream does

- use -g1 for debuginfo generation as this is what upstream

  does as well and it saves ~ 2GB of writes

- use %limit on x86_64 to scale down to less capable workers

- disable install stripping so that debuginfo is useful

- use autopatch

- cleanup constraints to specify only jobs, physicalmemory

  and memoryperjob to be more flexible on which host to build

  on

-------------------------------------------------------------------

Fri Jan 28 15:26:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 96.0.3 (bsc#1195230)

  * Fixed an issue that allowed unexpected data to be submitted in

    some of our search telemetry (bmo#1752317)

-------------------------------------------------------------------

Mon Jan 24 07:42:03 UTC 2022 - Martin Liška <mliska@suse.cz>

- Enable -fimplicit-constexpr for GCC 12+.

-------------------------------------------------------------------

Thu Jan 20 23:21:44 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 96.0.2

  * Fix an issue that caused tab height to display inconsistently

    on Linux when audio was played (bmo#1714276)

  * Fix an issue that caused Lastpass dropdowns to appear blank in

    Private Browsing mode (bmo#1748158)

  * Fix a crash encountered when resizing a Facebook app

    (bmo#1746084)

-------------------------------------------------------------------

Fri Jan 14 16:56:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 96.0.1

  * Fixed: Improvements to make the parsing of content-length

    headers more robust (bmo#1749957, boo#1194677)

-------------------------------------------------------------------

Sat Jan  8 10:32:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 96.0

  * https://www.mozilla.org/en-US/firefox/96.0/releasenotes

  MFSA 2022-01 (bsc#1194547)

  * CVE-2022-22746 (bmo#1735071)

    Calling into reportValidity could have lead to fullscreen

    window spoof

  * CVE-2022-22743 (bmo#1739220)

    Browser window spoof using fullscreen mode

  * CVE-2022-22742 (bmo#1739923)

    Out-of-bounds memory access when inserting text in edit mode

  * CVE-2022-22741 (bmo#1740389)

    Browser window spoof using fullscreen mode

  * CVE-2022-22740 (bmo#1742334)

    Use-after-free of ChannelEventQueue::mOwner

  * CVE-2022-22738 (bmo#1742382)

    Heap-buffer-overflow in blendGaussianBlur

  * CVE-2022-22737 (bmo#1745874)

    Race condition when playing audio files

  * CVE-2021-4140 (bmo#1746720)

    Iframe sandbox bypass with XSLT

  * CVE-2022-22750 (bmo#1566608)

    IPC passing of resource handles could have lead to sandbox

    bypass

  * CVE-2022-22749 (bmo#1705094)

    Lack of URL restrictions when scanning QR codes

  * CVE-2022-22748 (bmo#1705211)

    Spoofed origin on external protocol launch dialog

  * CVE-2022-22745 (bmo#1735856)

    Leaking cross-origin URLs through securitypolicyviolation

    event

  * CVE-2022-22744 (bmo#1737252)

    The 'Copy as curl' feature in DevTools did not fully escape

    website-controlled data, potentially leading to command

    injection

  * CVE-2022-22747 (bmo#1735028)

    Crash when handling empty pkcs7 sequence

  * CVE-2022-22736 (bmo#1742692)

    Potential local privilege escalation when loading modules

    from the install directory.

  * CVE-2022-22739 (bmo#1744158)

    Missing throttling on external protocol launch dialog

  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,

    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,

    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)

    Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

  * CVE-2022-22752 (bmo#1740534, bmo#1741210, bmo#1742770)

    Memory safety bugs fixed in Firefox 96

- removed obsolete patches

  * mozilla-bmo1745560.patch

  * mozilla-bmo1744896.patch

  * mozilla-sandbox-fips.patch

- requires

  NSPR >= 4.33

  NSS  >= 3.73.1

-------------------------------------------------------------------

Tue Dec 28 17:45:28 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Add upstream patches:

  * mozilla-bmo1745560.patch: Fix build against wayland 1.20.

  * mozilla-bmo1744896.patch: Create WaylandVsyncSource on window

    creation

-------------------------------------------------------------------

Mon Dec 20 21:57:30 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.2

  * Addresses frequent crashes experienced by users with C/E/Z-Series

    "Bobcat" CPUs running on Windows 7, 8, and 8.1.

- updated constraints for ppc and x86-64

-------------------------------------------------------------------

Fri Dec 17 13:49:16 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.1 (bsc#1193845)

  * Fixed frequent

    MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING error

    messages when trying to connect to various microsoft.com

    domains (bmo#1745600)

  * Fix for a WebRender crash on some Linux/X11 systems (bmo#1741956)

  * Fix for a frequent Windows shutdown crash (bmo#1738984)

  * Fix websites contrast issues for some Linux users with

    Dark mode set at OS level (bmo#1740518)

-------------------------------------------------------------------

Sat Dec  4 12:07:21 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0

  * You can now move the Picture-in-Picture toggle button to the

    opposite side of the video. Simply look for the new context menu

    option Move Picture-in-Picture Toggle to Left (Right) Side.

  * To better protect Firefox users against side-channel attacks such

    as Spectre, Site Isolation is now enabled for all Firefox 95 users.

  * https://www.mozilla.org/en-US/firefox/95.0/releasenotes

  MFSA 2021-52 (bsc#1193485)

  * CVE-2021-43536 (bmo#1730120)

    URL leakage when navigating while executing asynchronous

    function

  * CVE-2021-43537 (bmo#1738237)

    Heap buffer overflow when using structured clone

  * CVE-2021-43538 (bmo#1739091)

    Missing fullscreen and pointer lock notification when

    requesting both

  * CVE-2021-43539 (bmo#1739683)

    GC rooting failure when calling wasm instance methods

  * MOZ-2021-0010 (bmo#1735852)

    Use-after-free in fullscreen objects on MacOS

  * CVE-2021-43540 (bmo#1636629)

    WebExtensions could have installed persistent ServiceWorkers

  * CVE-2021-43541 (bmo#1696685)

    External protocol handler parameters were unescaped

  * CVE-2021-43542 (bmo#1723281)

    XMLHttpRequest error codes could have leaked the existence of

    an external protocol handler

  * CVE-2021-43543 (bmo#1738418)

    Bypass of CSP sandbox directive when embedding

  * CVE-2021-43544 (bmo#1739934)

    Receiving a malicious URL as text through a SEND intent could

    have led to XSS

  * CVE-2021-43545 (bmo#1720926)

    Denial of Service when using the Location API in a loop

  * CVE-2021-43546 (bmo#1737751)

    Cursor spoofing could overlay user interface when native

    cursor is zoomed

  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,

    bmo#1737009, bmo#1739372, bmo#1739421)

    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4

- requires

  NSS >= 3.72

-------------------------------------------------------------------

Thu Dec  2 20:32:42 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- remove x-scheme-handler/ftp from firefox.desktop boo#1193321

-------------------------------------------------------------------

Thu Nov 25 20:21:07 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Drop unused libidl-devel BuildRequires.

-------------------------------------------------------------------

Tue Nov 23 22:00:38 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.2:

  * Update preference design for Firefox Suggest for improved clarity

  * Resolved general instability/crashes on Linux caused by a file

    descriptor leak when backgrounding tabs using WebGL

    (bmo#1741997)

-------------------------------------------------------------------

Fri Nov  5 18:02:48 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 94.0.1:

  * fixes for other platforms

-------------------------------------------------------------------

Sat Oct 30 07:52:22 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 94.0

  * https://www.mozilla.org/en-US/firefox/94.0/releasenotes

  MFSA 2021-48 (bsc#1192250)

  * CVE-2021-38503 (bmo#1729517)

    iframe sandbox rules did not apply to XSLT stylesheets

  * CVE-2021-38504 (bmo#1730156)

    Use-after-free in file picker dialog

  * CVE-2021-38505 (bmo#1730194)

    Windows 10 Cloud Clipboard may have recorded sensitive user data

  * CVE-2021-38506 (bmo#1730750)

    Firefox could be coaxed into going into fullscreen mode

    without notification or warning

  * CVE-2021-38507 (bmo#1730935)

    Opportunistic Encryption in HTTP2 could be used to bypass the

    Same-Origin-Policy on services hosted on other ports

  * MOZ-2021-0003 (bmo#1736886)

    Universal XSS in Firefox for Android via QR Code URLs

  * CVE-2021-38508 (bmo#1366818)

    Permission Prompt could be overlaid, resulting in user

    confusion and potential spoofing

  * MOZ-2021-0004 (bmo#1659155)

    Web Extensions could access pre-redirect URL when their

    context menu was triggered by a user

  * CVE-2021-38509 (bmo#1718571)

    Javascript alert box could have been spoofed onto an

    arbitrary domain

  * CVE-2021-38510 (bmo#1731779)

    Download Protections were bypassed by .inetloc files on Mac OS

  * MOZ-2021-0005 (bmo#1719203)

    'Copy Image Link' context menu action could have been abused

    to see authentication tokens

  * MOZ-2021-0006 (bmo#1724233)

    URL Parsing may incorrectly parse internationalized domains

  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048, bmo#1735152)

    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

- removed obsolete patches

  * mozilla-bmo1602730.patch

  * mozilla-bmo1725828.patch

  * mozilla-bmo1729124.patch

- requires

  NSS >= 3.71

  rust >= 1.53

- fix Plasma detection (boo#1191825)

- fix Link error "undefined hidden symbol:"

  https://github.com/openSUSE/firefox-maintenance/issues/37

-------------------------------------------------------------------

Tue Oct 26 19:48:24 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires

- (re-)enable LTO on Tumbleweed

-------------------------------------------------------------------

Wed Oct 20 06:49:52 UTC 2021 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Rebase mozilla-sandbox-fips.patch to punch another hole in the

  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled

  from within the newly introduced socket process sandbox.

  This fixes bsc#1191815 and bsc#1190141

-------------------------------------------------------------------

Mon Oct 18 12:44:44 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix build on aarch64 (bmo#1729124)

  * mozilla-bmo1729124.patch

-------------------------------------------------------------------

Fri Oct  1 18:33:33 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 93.0

  * supports the new AVIF image format

  * PDF viewer now supports filling more forms (XFA-based forms)

  * now blocks downloads that rely on insecure connections,

    protecting against potentially malicious or unsafe downloads

  * Improved web compatibility for privacy protections with SmartBlock 3.0

  * Introducing a new referrer tracking protection in Strict Tracking

    Protection and Private Browsing

  * TLS ciphersuites that use 3DES have been disabled. Such

    ciphersuites can only be enabled when deprecated versions of