<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="15">
<package pkgid="d5956c69f2674314113c05513b842eb517f226ea1bcd1a9a4053bda65735a9a9ce2d6b10230cf099c5b365fcc1523416b440b46251e07d6e178467e79e834e11" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="d8749c0fcfb0384ed408ae15f016f7d49d0c999737c9d1a97f3d756dfdeca0e873f2f1c0753ff305859772e8cf20991ea707b9aa92627f43c2c773455e82d577" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="5ef1b3790309170733500714d65227d1c88bdebecd4da0d3d86bcf23a9a2dc4080c658576c1fcb72f7e6d21744c6c676704e54443c04e1d6324873bd6e1b3a47" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="320986f0a6b88a7aed8574f0a5a1264728abb8d6fcbb359e15c8a28a6bc20b4e4fec07476dfa97c38b11163dabe3126985aed1275ac4b2155a292b36c5d91565" name="MozillaFirefox-debuginfo" arch="x86_64">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="a3af5af1710b978f2a71fd65d5554a262f27557c530a5dcd04e3b90b850c2e386d4970621a2a6aea537950b9e4a7a59f8b823fcd9a34189d3abec74aa0a6fa8c" name="MozillaFirefox-debugsource" arch="x86_64">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="ca7f600d013d58378fc97df1eaeeb2d0cad5f1a849b059eb4f11651c49de60ec0641ac1ea1d046d21001dc290ad4e8e4791181f93679cbac68ef3f79e01acc7a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="920a2d1fa37499448ed16ee06896cc8b2620bd59030c6f23eba5bb08e2f9cb60a3ce6fbf688e7a6a3d8dbf08dd8405addb3f9deec3592756070067841913561d" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="c1f3b0c977582948f59a6b8961c947b429f94c6380da09ebdb9885054a105ee48dd736e1bf688151ebd83026769de081be80757ab27ed4c4dedb9f63adccb5cb" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="147.0.4" rel="1308.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
</package>
<package pkgid="faa20c9300909ab7d495429b8ecdb6b144960b12158a288316893c707865bd9e58d2a703cec163ea7abe40d6d475afb2866881e158bee5ed486e0e7f7d31b3b8" name="credentialsd" arch="i586">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
<package pkgid="ac73bc0f921de21f60d0bb5d273987be2c2ab31ecec71451da9d0dd1837a615316a8a8ffee75a74462a12c51952e336533440b2bee2b301177a61ebe7610db3a" name="credentialsd" arch="src">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
<package pkgid="83f529fac367991b6eef274f7c5880cddf3a7ec5de2861b8002ff3a19079e4f4a1ac7d79d60fb34d9ebdcc432002b43c102862760e75828ed347201fab62cd13" name="credentialsd" arch="x86_64">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
<package pkgid="7a99b6046caeb3636ecb1764fbaa219738aa11b21a89fbc8f02376a42f406819eefea12e449ea84076e7d36b7f8c685c2b44df3672db6da5d49593dd48ad7230" name="credentialsd-ui" arch="i586">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
<package pkgid="89ead83282e66b42e2f767db1c429839efcf53e16b47c6e30b49b2b578fe3f49d934b2bcc0f208061dbc878a31c61fac3e8334f5a52513a0e86e582db28285eb" name="credentialsd-ui" arch="x86_64">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
<package pkgid="6859c2d76909d71a5d810972722a8f717158af74ebc7f5a5b7e0b09e26ea78f98090dbf58c1414c52caa6085f9188701e4fca23a1bc7a7461f86c45fbfed0ba5" name="credentialsd-webextension" arch="i586">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
<package pkgid="76a3d46e172d0e9f81fc2b27124173f47931e72ebbbd989cbf090bbae2fdbd2c454c15beed2b31270aa73eff32dc07eda9eeafb7742c961f024c15d2d0c7555a" name="credentialsd-webextension" arch="x86_64">
  <version epoch="0" ver="0.2.0~0" rel="3.106"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754481600">- Initial commit</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568000">- Update to latest version
- Remove cargo_offline_build.patch, as upstream now has the option to build offline
- New package for webextension
- Systemd files for dbus activation</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1754568001">- Mark webextension package as NoArch and require python3-dbus_next</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- Update to first official 0.1 release
- Full renaming to credentialsd</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1771502400">- Update to 0.2.0
  Breaking Changes
  * Gateway API
  - Added window handle parameter
  * UI Controller API
  - Renamed `InitiateEventStream()` to `Subscribe()`.
  - Serialized `BackgroundEvent`, `HybridState`, `UsbState` as tag-value structs.
  - Added window handle parameter.
  * Improvements
  - Added NFC support.
  - Added PRF support.
  - Added translation support, with English and German translations.
  - Added client information the initial UI prompt.
  - Fixed user handle deserialization.
  - Added a GUI for demo client.
  - Notify user when a UV method is not set when required.</changelog>
</package>
</otherdata>