<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="58">
<package pkgid="76560df72c5cd659ed66d14e89c30093af6d44c0cf6572a9297d1fe25f2d2ee00739c9be46e35d7f36712392a04b4977d11206d54b22cdef9986774d5da6550c" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="145.0" rel="lp161.2.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747569600">- Mozilla Firefox 138.0.4
  MFSA 2025-36 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Fixed: Fixed a crash that could occur when viewing websites
    that use WebGL. (bmo#1961191)
  * Fixed: Fixed an issue where the browser could repeatedly
    crash when certain SVG effects (like blur or drop shadow)
    were applied to very small areas. (bmo#1924241)
    (bmo#1924241)
  * Fixed: On Linux, fixed an issue where video playback would
    appear washed-out on Wayland when HDR support was
    unavailable. (bmo#1961610)
  * Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
    in the find-in-page toolbar did not toggle the checkbox as
    expected. (bmo#1952611)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Firefox 139.0
  https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
  MFSA 2025-42 (bsc#1243353)
  * MFSA-TMP-2025-0001 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5270 (bmo#1910298)
    SNI was sometimes unencrypted
  * CVE-2025-5271 (bmo#1920348)
    Devtools' preview ignored CSP headers
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
    Memory safety bugs fixed in Firefox 139 and Thunderbird 139</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1748692800">- Mozilla Firefox 139.0.1
  https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
  * Fixed graphics corruption with certain NVIDIA graphics adapters
    and multiple monitors running at mixed refresh rates after
    updating to Firefox 139. (bmo#1968876)</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1748952000">- Fix %{progdir}/crashhelper packaging</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
</package>
<package pkgid="8d20c26772ee1a4d858022a75adf693e7238f71fa767c3a4e6d4b76fa32a13cc31c77e5a2a0b1310a2b700d7cbf4c51ca7db0afb8a28ab400116d17cfe8022c0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="145.0" rel="lp161.2.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747569600">- Mozilla Firefox 138.0.4
  MFSA 2025-36 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Fixed: Fixed a crash that could occur when viewing websites
    that use WebGL. (bmo#1961191)
  * Fixed: Fixed an issue where the browser could repeatedly
    crash when certain SVG effects (like blur or drop shadow)
    were applied to very small areas. (bmo#1924241)
    (bmo#1924241)
  * Fixed: On Linux, fixed an issue where video playback would
    appear washed-out on Wayland when HDR support was
    unavailable. (bmo#1961610)
  * Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
    in the find-in-page toolbar did not toggle the checkbox as
    expected. (bmo#1952611)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Firefox 139.0
  https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
  MFSA 2025-42 (bsc#1243353)
  * MFSA-TMP-2025-0001 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5270 (bmo#1910298)
    SNI was sometimes unencrypted
  * CVE-2025-5271 (bmo#1920348)
    Devtools' preview ignored CSP headers
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
    Memory safety bugs fixed in Firefox 139 and Thunderbird 139</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1748692800">- Mozilla Firefox 139.0.1
  https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
  * Fixed graphics corruption with certain NVIDIA graphics adapters
    and multiple monitors running at mixed refresh rates after
    updating to Firefox 139. (bmo#1968876)</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1748952000">- Fix %{progdir}/crashhelper packaging</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
</package>
<package pkgid="975f9762839ea7666b0378747ee769b4c29994c38cad5dd621e45456e18f17dc7ca9843d3ab6dbb7c55bf1e79dfc697ce50e33dd2023b07e75f1a4bf1dc47102" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="146.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1</changelog>
</package>
<package pkgid="6008763fbd3cd5c4306bd8c5f1f681b979f450728466883d5b55136c11fe8740322788a937a3f3e0a6b83ad775515505787ed6ac508401671cdf3a8ec3dec00b" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="146.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1</changelog>
</package>
<package pkgid="abca844f11749b1bb1438adf35c5a31b4f56c4f17e80cfd48810fcd78d12aadbefd28926b63833b970b1f45f8ab90f59c8747503cfe25c63f090db9cdecc0d95" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="147.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
- requires NSS &gt;= 3.119</changelog>
</package>
<package pkgid="93ed196574455f70bc151c7b6368aca6f46a03a67f7eca01737c05fa00a0bb161736edc4c114b41ec445461f6c63e4c3f3a0c262196bd69954f38e3cf1358567" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="147.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
- requires NSS &gt;= 3.119</changelog>
</package>
<package pkgid="151ba0feb8620777c854701a02613df32bbd245b1c7a0b26673ab69375cdde5b1d164dc4eb41a9ba97cc36f720ed2076f055dc6629f0bdde48078a89c84a53ad" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="148.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771848000">- Mozilla Firefox 148.0
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build</changelog>
</package>
<package pkgid="a4199695b5509ced6fe33d83c17c9ce1582ee19fe28d2b43b428337a78f0c4a50abf3d2638b4804f3b39c5ae0b91a11872b6e771588f28d5000c2e400834d2e0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="148.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771848000">- Mozilla Firefox 148.0
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build</changelog>
</package>
<package pkgid="31c34fc99084eed70ce6290fcf85fcfb021c8c3de638d94b837c2a4a846ed8d4c04a731743548a528617c65345edb05a083b6a948f404bdc654561bf7024e4a1" name="MozillaFirefox-branding-openSUSE" arch="src">
  <version epoch="0" ver="68" rel="lp161.22.1"/>
  <changelog author="wr@rosenauer.org" date="1445256000">- change homepage to https://www.opensuse.org/searchPage/
  (boo#950948, boo#950949)</changelog>
  <changelog author="wr@rosenauer.org" date="1450440000">- identify Tumbleweed correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1468238400">- Identify the different Leap versions correctly (up to Leap 42.2)
  (boo#987969).</changelog>
  <changelog author="qantas94heavy@gmail.com" date="1481284800">- Fix openSUSE bookmarks not added to default profile (boo#1014292)
  * Move openSUSE bookmarks from toolbar to menu
  * Use local favicon for all bookmarks (Firefox 45+)
  * Fix links to "openSUSE Documentation" and "How to Participate"
    (boo#704121, boo#953164)
- Remove DuckDuckGo search plugin (included upstream)
- Clean up spec file
  * Change $RPM_BUILD_ROOT to %{buildroot}
  * Remove %clean section
  * Escape % symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1493380800">- recognize Leap 42.3 (boo#1036679)</changelog>
  <changelog author="wr@rosenauer.org" date="1496664000">- really fix boo#1036679 (recognize Leap 42.3)</changelog>
  <changelog author="wr@rosenauer.org" date="1522584000">- recognize Leap 15.0 (boo#1087713)</changelog>
  <changelog author="wr@rosenauer.org" date="1535198400">- removed intl.locale.matchOS
  * it's not used in recent versions and it was set in the general
    openSUSE Firefox package since 2011</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1556020800">- bump version to 60 for SLE compatibility (bsc#1128316)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1557057600">- recognize Leap 15 via sle_version (required for &gt;= 15.1)</changelog>
  <changelog author="Lubos Kocman &lt;Lubos.Kocman+factory@suse.de&gt;" date="1563364800">- recognize Leap 15.2 via sle_version</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1568030400">- layout.word_select.stop_at_punctuation -&gt; true (boo#1133163)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1570190400">- removed extensions preferences (moved to core package)
- use multibuild to provide branding package for
  MozillaFirefox and firefox-esr</changelog>
  <changelog author="Stasiek Michalski &lt;stasiek@michalski.cc&gt;" date="1584619200">- Update the default homepage and the bookmark icons</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1632484800">- use HTTPS for software search plugin</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1639742400">- add sle_version 150300 and 150400 check</changelog>
  <changelog author="Rischio Cinico &lt;rischiocinico@gmail.com&gt;" date="1645876800">- add some useful links about openSUSE in the about:newtab page</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1660046400">- add sle_version 150500 check</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1730721600">- add properties to use xdg-desktop-portal (boo#1226112)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1731240000">- do not use XDG for mime-handler as it does not handle the default
  browser check correctly</changelog>
</package>
<package pkgid="e7015268a2a06016cd70cf48366ce0f591a370ec2eb48d6dd90d82a4722194ee0464afe0864bda2ae77aa261966beae9fec9a6fec7d4f10bbb87b6e005b67ff0" name="MozillaFirefox-branding-openSUSE" arch="x86_64">
  <version epoch="0" ver="68" rel="lp161.22.1"/>
  <changelog author="wr@rosenauer.org" date="1445256000">- change homepage to https://www.opensuse.org/searchPage/
  (boo#950948, boo#950949)</changelog>
  <changelog author="wr@rosenauer.org" date="1450440000">- identify Tumbleweed correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1468238400">- Identify the different Leap versions correctly (up to Leap 42.2)
  (boo#987969).</changelog>
  <changelog author="qantas94heavy@gmail.com" date="1481284800">- Fix openSUSE bookmarks not added to default profile (boo#1014292)
  * Move openSUSE bookmarks from toolbar to menu
  * Use local favicon for all bookmarks (Firefox 45+)
  * Fix links to "openSUSE Documentation" and "How to Participate"
    (boo#704121, boo#953164)
- Remove DuckDuckGo search plugin (included upstream)
- Clean up spec file
  * Change $RPM_BUILD_ROOT to %{buildroot}
  * Remove %clean section
  * Escape % symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1493380800">- recognize Leap 42.3 (boo#1036679)</changelog>
  <changelog author="wr@rosenauer.org" date="1496664000">- really fix boo#1036679 (recognize Leap 42.3)</changelog>
  <changelog author="wr@rosenauer.org" date="1522584000">- recognize Leap 15.0 (boo#1087713)</changelog>
  <changelog author="wr@rosenauer.org" date="1535198400">- removed intl.locale.matchOS
  * it's not used in recent versions and it was set in the general
    openSUSE Firefox package since 2011</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1556020800">- bump version to 60 for SLE compatibility (bsc#1128316)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1557057600">- recognize Leap 15 via sle_version (required for &gt;= 15.1)</changelog>
  <changelog author="Lubos Kocman &lt;Lubos.Kocman+factory@suse.de&gt;" date="1563364800">- recognize Leap 15.2 via sle_version</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1568030400">- layout.word_select.stop_at_punctuation -&gt; true (boo#1133163)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1570190400">- removed extensions preferences (moved to core package)
- use multibuild to provide branding package for
  MozillaFirefox and firefox-esr</changelog>
  <changelog author="Stasiek Michalski &lt;stasiek@michalski.cc&gt;" date="1584619200">- Update the default homepage and the bookmark icons</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1632484800">- use HTTPS for software search plugin</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1639742400">- add sle_version 150300 and 150400 check</changelog>
  <changelog author="Rischio Cinico &lt;rischiocinico@gmail.com&gt;" date="1645876800">- add some useful links about openSUSE in the about:newtab page</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1660046400">- add sle_version 150500 check</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1730721600">- add properties to use xdg-desktop-portal (boo#1226112)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1731240000">- do not use XDG for mime-handler as it does not handle the default
  browser check correctly</changelog>
</package>
<package pkgid="5ac1f30ce31c9dea718f8426debe4ec3542724a5648509e8df1105f07d38b8bdb6db6b0344edc6f90e075ced9fbf588495a5997f5dab592cd1d2b28970539841" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="145.0" rel="lp161.2.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747569600">- Mozilla Firefox 138.0.4
  MFSA 2025-36 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Fixed: Fixed a crash that could occur when viewing websites
    that use WebGL. (bmo#1961191)
  * Fixed: Fixed an issue where the browser could repeatedly
    crash when certain SVG effects (like blur or drop shadow)
    were applied to very small areas. (bmo#1924241)
    (bmo#1924241)
  * Fixed: On Linux, fixed an issue where video playback would
    appear washed-out on Wayland when HDR support was
    unavailable. (bmo#1961610)
  * Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
    in the find-in-page toolbar did not toggle the checkbox as
    expected. (bmo#1952611)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Firefox 139.0
  https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
  MFSA 2025-42 (bsc#1243353)
  * MFSA-TMP-2025-0001 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5270 (bmo#1910298)
    SNI was sometimes unencrypted
  * CVE-2025-5271 (bmo#1920348)
    Devtools' preview ignored CSP headers
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
    Memory safety bugs fixed in Firefox 139 and Thunderbird 139</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1748692800">- Mozilla Firefox 139.0.1
  https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
  * Fixed graphics corruption with certain NVIDIA graphics adapters
    and multiple monitors running at mixed refresh rates after
    updating to Firefox 139. (bmo#1968876)</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1748952000">- Fix %{progdir}/crashhelper packaging</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
</package>
<package pkgid="9065ddd37031943018409e79debcc44369a51d3e4023cb14bc0dc5753909aa9b744083d002bc231809ffea34cf55eedca9beaf956b37b27712297cedc142ca0d" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="146.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1</changelog>
</package>
<package pkgid="1ea07e0533fee4407290212a8a92552da2b36a73620c4c1d38b7046b543fb2bf52882dcab6718ceef52447d9bd88b2ca104cef19c36a7a83a1b653ddd930d6d3" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="147.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
- requires NSS &gt;= 3.119</changelog>
</package>
<package pkgid="c69340b8309aa8367aae9df843f9588215de04882a101ef011a7364a91196fb3e136da010b30c6a9d1aa1741aebc9fbb753ddba64ef56ca249c289e2c5cf8abf" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="148.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771848000">- Mozilla Firefox 148.0
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build</changelog>
</package>
<package pkgid="8b9cd94947c15bed5266a31a5134bc86f7cf96f9e9987f721f26d2619f3492234a3bcbdfd69fa233963d7835afa4ba6ec58051cd4df58e7009ae8f4e05010e01" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="145.0" rel="lp161.2.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747569600">- Mozilla Firefox 138.0.4
  MFSA 2025-36 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Fixed: Fixed a crash that could occur when viewing websites
    that use WebGL. (bmo#1961191)
  * Fixed: Fixed an issue where the browser could repeatedly
    crash when certain SVG effects (like blur or drop shadow)
    were applied to very small areas. (bmo#1924241)
    (bmo#1924241)
  * Fixed: On Linux, fixed an issue where video playback would
    appear washed-out on Wayland when HDR support was
    unavailable. (bmo#1961610)
  * Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
    in the find-in-page toolbar did not toggle the checkbox as
    expected. (bmo#1952611)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Firefox 139.0
  https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
  MFSA 2025-42 (bsc#1243353)
  * MFSA-TMP-2025-0001 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5270 (bmo#1910298)
    SNI was sometimes unencrypted
  * CVE-2025-5271 (bmo#1920348)
    Devtools' preview ignored CSP headers
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
    Memory safety bugs fixed in Firefox 139 and Thunderbird 139</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1748692800">- Mozilla Firefox 139.0.1
  https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
  * Fixed graphics corruption with certain NVIDIA graphics adapters
    and multiple monitors running at mixed refresh rates after
    updating to Firefox 139. (bmo#1968876)</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1748952000">- Fix %{progdir}/crashhelper packaging</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
</package>
<package pkgid="a3d27ae36ad8444d53a83b444a9fe5ecaf7c31795bfd27e29af334495f0dc092d9be704e64f0f09d17c4412ab667d475c01f50c649e93339e12d781ad29b7deb" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="146.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1</changelog>
</package>
<package pkgid="4f2edc78e2a5dec0166a20b6c5fcccc0d6da3e026fc0bd67c71303886380b94026794fddc53fefd56a923c86ad4d716e5aa7d67ae3eff0a9886c40a0cfe2c651" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="147.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
- requires NSS &gt;= 3.119</changelog>
</package>
<package pkgid="fbe20447a2789c08100916a9b598df732e31f6b4d49e462a22688b5be7019299e1e7fa3f236cb69431ec789842905cf4ce69ec4a0f7ba368acdce473e5133896" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="148.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771848000">- Mozilla Firefox 148.0
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build</changelog>
</package>
<package pkgid="f29cf444c7a50fef4435f590852334ad3e64224d9b4acf43a93ac4afc25cd5bc6e34041d96a775f787aa4a83a7927dcc968f093476cbee7e9f6b8b05957947e5" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="145.0" rel="lp161.2.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747569600">- Mozilla Firefox 138.0.4
  MFSA 2025-36 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Fixed: Fixed a crash that could occur when viewing websites
    that use WebGL. (bmo#1961191)
  * Fixed: Fixed an issue where the browser could repeatedly
    crash when certain SVG effects (like blur or drop shadow)
    were applied to very small areas. (bmo#1924241)
    (bmo#1924241)
  * Fixed: On Linux, fixed an issue where video playback would
    appear washed-out on Wayland when HDR support was
    unavailable. (bmo#1961610)
  * Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
    in the find-in-page toolbar did not toggle the checkbox as
    expected. (bmo#1952611)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Firefox 139.0
  https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
  MFSA 2025-42 (bsc#1243353)
  * MFSA-TMP-2025-0001 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5270 (bmo#1910298)
    SNI was sometimes unencrypted
  * CVE-2025-5271 (bmo#1920348)
    Devtools' preview ignored CSP headers
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
    Memory safety bugs fixed in Firefox 139 and Thunderbird 139</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1748692800">- Mozilla Firefox 139.0.1
  https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
  * Fixed graphics corruption with certain NVIDIA graphics adapters
    and multiple monitors running at mixed refresh rates after
    updating to Firefox 139. (bmo#1968876)</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1748952000">- Fix %{progdir}/crashhelper packaging</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
</package>
<package pkgid="0465cb7cc88f67408949280303b8bb09e6ef36fad6d4e92c60fb76cc8e2996ca37d279f2c70b8310ce2327fc6672f23eba83635001322cf466c818fd9c7fc90a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="146.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1</changelog>
</package>
<package pkgid="e184c836f9c547a56fcb694d81385911219b29bcc4fb9646ab51e07d19073204c8266dddf54d5d27dcfc266aee3e530844b027cebf559bdac27674a74ff04c9c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="147.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
- requires NSS &gt;= 3.119</changelog>
</package>
<package pkgid="408a5cc1b7e2d0489d03d67ada166b25f0d765d3560a42fe2bbc821a70238b3d6bd422522d138c7535d1db82d415356900385c37a771ed4c0b6474e5cea51522" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="148.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771848000">- Mozilla Firefox 148.0
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build</changelog>
</package>
<package pkgid="f72d44899784ae63a1f4dd94ecc4bfde0c12d99d3930ed48da230e8ea802b8e3b8604b9e6393970f8d35ea9aba6a92d34506751708656670401e02f6ad2dabe2" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="145.0" rel="lp161.2.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747569600">- Mozilla Firefox 138.0.4
  MFSA 2025-36 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Fixed: Fixed a crash that could occur when viewing websites
    that use WebGL. (bmo#1961191)
  * Fixed: Fixed an issue where the browser could repeatedly
    crash when certain SVG effects (like blur or drop shadow)
    were applied to very small areas. (bmo#1924241)
    (bmo#1924241)
  * Fixed: On Linux, fixed an issue where video playback would
    appear washed-out on Wayland when HDR support was
    unavailable. (bmo#1961610)
  * Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
    in the find-in-page toolbar did not toggle the checkbox as
    expected. (bmo#1952611)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Firefox 139.0
  https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
  MFSA 2025-42 (bsc#1243353)
  * MFSA-TMP-2025-0001 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5270 (bmo#1910298)
    SNI was sometimes unencrypted
  * CVE-2025-5271 (bmo#1920348)
    Devtools' preview ignored CSP headers
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
    Memory safety bugs fixed in Firefox 139 and Thunderbird 139</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1748692800">- Mozilla Firefox 139.0.1
  https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
  * Fixed graphics corruption with certain NVIDIA graphics adapters
    and multiple monitors running at mixed refresh rates after
    updating to Firefox 139. (bmo#1968876)</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1748952000">- Fix %{progdir}/crashhelper packaging</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
</package>
<package pkgid="a39763485060e86bb0e6aecac848ca07f365ead0c17d8e38c4d31cddbe6867e8f83596a932e91a3078192e0f796202ddb4e82728af3590c13b5ea3a21d2fd5b5" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="146.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749643200">- Firefox 139.0.4 Release
  * Fixed: Fixed Firefox freezing when switching between apps or
    opening certain panels within the browser. (Bug 1969253 &amp; Bug
    1969346)
  * Fixed: Fixed difficult selection of drop-down menu options in
    the Firefox preferences page when selected via the in-page
    search. (bmo#1968949)
  * Fixed: Fixed various selection issues when triple-clicking
    text in some situations. (Bug 1969100 &amp; Bug 1969432)
  * Fixed: Fixed an incorrect filename being used when setting an
    image as the desktop wallpaper on Windows. (bmo#1969793)
  * Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
  https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
  MFSA 2025-47 (bsc#1244468)
  * CVE-2025-49709 (bmo#1966083)
    Memory corruption in canvas surfaces
  * CVE-2025-49710 (bmo#1970095)
    Integer overflow in OrderedHashTable</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750766400">- Firefox 140.0 Release
  * New: Vertical Tabs: You can now keep more — or fewer — pinned
    tabs in view for quicker access to important windows. Just
    drag the divider to resize your pinned tabs section.
  * New: Custom Search Engines: Firefox now supports adding even
    more search engines. To add a custom engine, right-click a
    search field of a supported website and select “Add Search
    Engine”, or go to Settings &gt; Search &gt; Add (below the search
    shortcuts table) to manually enter a search URL.
  * New: Firefox Extensions: Customize your toolbar with the
    option to remove the extensions shortcut, giving you more
    control over your browser. When the button is hidden, you can
    access the extensions panel again at any time from the
    Firefox menu by clicking the Extensions menu item.
  * New: You can now unload tabs by right-clicking on a tab (or
    multiple selected tabs) and selecting "Unload Tab". This can
    speed up performance by reducing Firefox's memory and CPU
    usage.
  * New: Full-Page Translations now prioritizes translating only
    the content near your current view, improving speed and
    responsiveness. Content outside your view is skipped unless
    you scroll to it, reducing unnecessary resource usage.
  * New: Firefox builds in Arabic now come with a built-in Arabic
    dictionary for the Firefox spellchecker.
  * New: Address autofill enabled for users in Italy, Poland, and
    Austria.
  * Changed: The Pocket toolbar icon, as well as the Pocket
    integrations on New Tab, have been removed per the service
    shutdown announcement.
  * HTML5: Added platform support for aria-keyshortcuts in Linux,
    macOS, and Windows.
  * HTML5: Added support for the CookieStore API, an asynchronous
    cookie API for scripts running in HTML documents and service
    workers.
  * HTML5: Added support for the Custom Highlight API, which
    allows styling arbitrary text ranges. Support for text-
    decoration is not included and is planned for an upcoming
    release.
  * HTML5: Added support for the pointerrawupdate event. This
    event provides lower-latency access to pointer movements by
    firing as soon as the pointer data is available, typically
    before the main `pointermove` event. Unlike `pointermove`, it
    performs an additional hit test to determine the target and
    fires more frequently, which may impact performance even if
    only a listener is added. This event is intended for
    applications that require high-precision input handling and
    cannot achieve smooth interaction using coalesced
    `pointermove` events alone.
  * HTML5: Service Workers are now available in Private Browsing
    Mode. This enhancement builds on our efforts to support
    IndexedDB and the DOM Cache API in Private Browsing through
    encrypted storage. With this change, more websites,
    especially those that rely on background tasks, will be able
    to benefit from Service workers.
  * HTML5: Firefox now applies a uniform user agent (UA) style to
    `&lt;h1&gt;` elements, regardless of whether they are used inside
    `&lt;article&gt;`, `&lt;aside&gt;`, `&lt;nav&gt;`, or `&lt;section&gt;`.
  * HTML5: Firefox will now escape less-than (`&lt;`) and greater-
    than (`&gt;`) symbols when serializing HTML attributes, making
    certain mXSS attacks on websites more difficult.
  * Developer: Improved the search feature in the Inspector panel
    to help developers more effectively search the DOM of the
    current page. Sorting the results by the number of matching
    elements, support “pseudo” selector state, etc.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    140 Release Notes.
  * Fixed: Various security fixes.
- Mozilla Firefox 140.0
  https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
  NSS &gt;= 3.112
  cargo/rust 1.86</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1</changelog>
</package>
<package pkgid="f357004d9ee7e8e4ddcadb546f29539ed6c5844d3af1c34929e7190a6d8bfb47b8f2e57bd73622c92fc0176ee944d95318b7dcf427fd8243d85a46ff4f600904" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="147.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Firefox 140.0.2
  * Fixed a startup crash on Windows experienced by some users
    (bmo#1974259)
- Mozilla Firefox 140.0.1
  * Fixed text contrast issues in the sidebar with some dark themes
    (bmo#1971487)
  * Fixed a startup crash experienced by some users caused by DLL
    injection (mbo#1973947)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1753012800">- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753617600">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Firefox 141.0.2
  * Fixed a startup crash experienced by some Linux users with outdated
    NVIDIA drivers. (bmo#1978911)
  * Fixed a regression that caused canvas objects to be draggable,
    causing web compatibility issues. (bmo#1978673)
  * Fixed a crash in the Web Developer Tools panel that could occur
    when inspecting pages with &lt;iframe&gt; elements. (bmo#1975277)
  * Fixed minor visual issues across the user interface.
    (bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
  * Firefox wouldn't start on some systems where GTK+ was built
    without Wayland support. (bmo#1978620)
  * Fixed an issue where clicking a pinned tab could steal focus from
    the content area, disrupting keyboard navigation. (bmo#1977005)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1755777600">- Mozilla Firefox 142
  https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
  MFSA 2025-64 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9186 (bmo#1445758)
    Spoofing issue in the Address Bar component of Firefox Focus
    for Android
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9183 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
    bmo#1979072)
    Memory safety bugs fixed in Firefox 142 and Thunderbird 142
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
- requires NSS &gt;= 3.119</changelog>
</package>
<package pkgid="6f079473c7488156485c67b318f28837811c300ebd0ac38824358be13b0cfdfa73a152911a2d60a4fda3da0c5ddc000b939c060dee5db25ea0f50e08a7e94db6" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="148.0" rel="lp161.2.4"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1756555200">- Mozilla Firefox 142.0.1
  * Dragging multiple non-adjacent tabs in horizontal tab strip mode
    now correctly moves them together as a group. (bmo#1982933)
  * Dragging multiple tabs no longer causes toolbar unresponsiveness
    or visual glitches. (bmo#1984342)
  * Fixed an issue where the text cursor appeared in the wrong
    location. (bmo#1984045)
  * Fixed a crash related to gamepad use, particularly on macOS
    (bmno#1870379)
  * Fixed an issue where the expand on hover feature in the sidebar
    would sometimes stop working. (bmo#1982129)
  * Fixed a crash in KDE Plasma when using certain custom window
    decorations. (bmo#1984823)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1757073600">- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
  build.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Firefox 143.0
  https://www.firefox.com/en-US/firefox/143.0/releasenotes
  MFSA 2025-73 (bsc#1249391)
  * CVE-2025-10527 (bmo#1984825)
    Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  * CVE-2025-10528 (bmo#1986185)
    Sandbox escape due to undefined behavior, invalid pointer in
    the Graphics: Canvas2D component
  * CVE-2025-10529 (bmo#1970490)
    Same-origin policy bypass in the Layout component
  * CVE-2025-10530 (bmo#1974025)
    Spoofing issue in the WebAuthn component in Firefox for Android
  * CVE-2025-10531 (bmo#1978453)
    Mitigation bypass in the Web Compatibility: Tooling component
  * CVE-2025-10532 (bmo#1979502)
    Incorrect boundary conditions in the JavaScript: GC component
  * CVE-2025-10533 (bmo#1980788)
    Integer overflow in the SVG component
  * CVE-2025-10534 (bmo#1665334)
    Spoofing issue in the Site Permissions component
  * CVE-2025-10535 (bmo#1979918)
    Information disclosure, mitigation bypass in the Privacy
    component in Firefox for Android
  * CVE-2025-10536 (bmo#1981502)
    Information disclosure in the Networking: Cache component
  * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
    bmo#1981283, bmo#1984505, bmo#1985067)
    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
    ESR 140.3, Firefox 143 and Thunderbird 143
- requires
  NSPR 4.37
  NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758369600">- Mozilla Firefox 143.0.1:
  https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
  * Fixed a tab crash experienced by some users caused by DLL
    injection (bmo#1872261)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1759233600">- Mozilla Firefox 143.0.3
  https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
  MFSA 2025-80 (bsc#1250678
  * CVE-2025-11152 (bmo#1987246)
    Sandbox escape due to integer overflow in the Graphics: Canvas2D component
  * CVE-2025-11153 (bmo#1987481)
    JIT miscompilation in the JavaScript Engine: JIT component</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760270400">- Mozilla Firefox 144.0
  please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
  for all news
  MFSA 2025-81 (bsc#1251263)
  * CVE-2025-11708 (bmo#1988931)
    Use-after-free in MediaTrackGraphImpl::GetInstance()
  * CVE-2025-11709 (bmo#1989127)
    Out of bounds read/write in a privileged process triggered by
    WebGL textures
  * CVE-2025-11710 (bmo#1989899)
    Cross-process information leaked due to malicious IPC messages
  * CVE-2025-11711 (bmo#1989978)
    Some non-writable Object properties could be modified
  * CVE-2025-11716 (bmo#1818679)
    Sandboxed iframes allowed links to open in external apps
    (Android only)
  * CVE-2025-11717 (bmo#1872601)
    The password edit screen was not hidden in Android card view
  * CVE-2025-11712 (bmo#1979536)
    An OBJECT tag type attribute overrode browser behavior on web
    resources without a content-type
  * CVE-2025-11718 (bmo#1980808)
    Address bar could be spoofed on Android using visibilitychange
  * CVE-2025-11713 (bmo#1986142)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-11719 (bmo#1991950)
    Use-after-free caused by the native messaging web extension
    API on Windows
  * CVE-2025-11720 (bmo#1979534, bmo#1984370)
    Spoofing risk in Android custom tabs
  * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
    bmo#1991040, bmo#1992113)
    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
    bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
    ESR 140.4, Firefox 144 and Thunderbird 144
  * CVE-2025-11721 (bmo#1986816)
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
  NSS &gt;= 3.116
  rust = 1.88
    (upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
  and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
  officially discontinues any 32bit support for Linux with 145
  https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760875200">- fix miscompilation with gcc and using it for build
  (mozilla-bmo1990430.patch)</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1761739200">- Mozilla Firefox 144.0.2
  * Fixed: Fixed an issue where the list of available locales in
    `about:settings` contained more locales than were downloaded
    or currently supported. (bmo#1994642)
  * Fixed: Fixed an issue where using the keyboard to open the
    Unified Search dropdown was inconsistent. The dropdown now
    expands properly, allowing users to select a search engine
    using the keyboard. (bmo#1979826)
  * Fixed: Fixed an issue where curated photo collections on
    Microsoft OneDrive's Photos “For You” page failed to load,
    showing a gray screen instead of content. Collections now
    display as expected. (bmo#1986533)
  * Fixed: Fixed a startup crash affecting Windows users with
    Avast or other security software installed. (bmo#1992678)
  * Fixed: Fixed an issue on macOS where the emoji picker
    shortcut and menu entry stopped working after switching
    between apps. (bmo#1980815)
  * Fixed: Fixed an issue on macOS where dragging images from
    Firefox into third-party apps like Preview could fail or
    behave unexpectedly. (bmo#1995345)
  * Fixed: Fixed performance and video playback issues on macOS
    26 (Tahoe) that occurred when the system was under heavy
    load. (bmo#1995638)
  * Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
    occur when bookmark folders contained loops or repeated
    references to themselves. (bmo#1995621)
  * Fixed: Security fix.
  MFSA 2025-86 (bsc#1252815)
  * CVE-2025-12380 (bmo#1993113)
    Use-after-free in WebGPU internals triggered from a
    compromised child process
- Removed upstreamed mozilla-bmo1990430.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1762689600">- Mozilla Firefox 145.0
  * New: Add, edit, and delete comments to make your own notes in
    PDFs (summaries, questions, tasks, etc.). The comment sidebar
    helps you scan all your comments and quickly jump to them,
    which is handy for long or heavily marked-up PDFs.
  * New: This version introduces a new phase of privacy
    protections, building on our research on reducing browser
    fingerprinting. These new defenses cut the percentage of
    users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when
    using *Enhanced Tracking Protection* set to *Strict*.
  * New: Need a reminder of what tabs are in a group? Hover over
    the tab group name to get a preview of the tabs inside
    without opening it. (bmo#1992228)
  * New: You can now access and manage your saved passwords right
    from the sidebar—no need to open a new tab or window. Stay on
    the page you’re on and get to your logins faster.
  * New: Copy Link to Highlight allows users to share arbitrary
    sections of a page with others by copying a link through the
    context menu with a given selection
  * New: The Translations feature has an improved experience when
    translating between languages with different script
    directions.
  * New: New brand-inspired wallpapers are available for New Tab
    on desktop, with versions for both light and dark mode.
  * New: With the new Open links from apps next to your active
    tab setting, you can have links from other applications open
    next to your active tab instead of at the end of the tab
    strip.
  * New: Enhanced Bounce Tracking Protection’s stateless mode is
    now enabled by default in ETP Strict, blocking more advanced
    tracking techniques based on redirection
  * New: For most Windows users, the existing desktop shortcut
    for launching Firefox has been replaced with the desktop
    launcher, a small program that will launch Firefox if it is
    installed, but if it is not installed will prompt the user to
    install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where
    Firefox will not be installed by default, but the desktop
    launcher program may have synced via OneDrive or other cloud
    storage product. Learn more.
  * Changed: Firefox no longer supports 32-bit Linux systems. We
    recommend installing the 64-bit version for continued updates
    and support.
  * Changed: Horizontal tabs are now slightly more rounded to
    match the look of vertical tabs. Buttons and text inputs,
    including the address bar, have also been updated for
    consistency. (bmo#1988794)
  * Changed: When no extensions are installed, clicking the
    Extensions button now shows a message highlighting how
    extensions can enhance your browsing, with links to the
    Firefox Add-ons store. (bmo#1778684)
  * Changed: Local translation models are now compressed with
    Zstandard, reducing download sizes and on-device storage
    consumption. As always, all Firefox translations happen
    securely and privately on your local device, unlike other
    browsers that translate using cloud services.
  * Changed: We updated default automation preferences to better
    support Agentic browsing, reducing the steps agents need to
    complete a task and chances for the agent to get stuck.
    (bmo#1991970)
  * HTML5: Support has been added for the `Atomics.waitAsync`
    proposal, which is a non-blocking, asynchronous version of
    `Atomics.wait`. This allow synchronization of threads based
    upon the value in a shared memory location, for more details
    please consult our MDN documentation.
  * HTML5: Firefox now supports the new `Integrity-Policy` header
    for enforcing sub-resource integrity for scripts. Further
    implementation of this header is underway.
  * HTML5: Added Matroska support for the most commonly used
    codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
    (bmo#1991752)
  * HTML5: The text-autospace property is now supported, allowing
    automatic spacing adjustments between characters from
    different scripts.
  * HTML5: The WebGPU DOM API (spec; MDN) is now available on
    macOS 26 (Tahoe) on Apple Silicon. For details, see the
    Mozilla Graphics Team Blog.
  * Developer: Microsoft UI Automation phased release rollout at
    100%. Microsoft UI Automation is the new accessibility
    framework for Microsoft Windows. This will provide better
    assistive technology (AT) support and performance on Windows
    for current and future assistive technologies.
  * Enterprise: You can find information about policy updates and
    enterprise specific bug fixes in the Firefox for Enterprise
    145 Release Notes.
  * Fixed: Various security fixes.
  MFSA 2025-87 (bsc#1253188)
  * CVE-2025-13021 (bmo#1986431)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13022 (bmo#1988488)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13012 (bmo#1991458)
    Race condition in the Graphics component
  * CVE-2025-13023 (bmo#1992032)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13016 (bmo#1992130)
    Incorrect boundary conditions in the JavaScript: WebAssembly
    component
  * CVE-2025-13024 (bmo#1992902)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-13025 (bmo#1994022)
    Incorrect boundary conditions in the Graphics: WebGPU
    component
  * CVE-2025-13026 (bmo#1994441)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: WebGPU component
  * CVE-2025-13017 (bmo#1980904)
    Same-origin policy bypass in the DOM: Notifications component
  * CVE-2025-13018 (bmo#1984940)
    Mitigation bypass in the DOM: Security component
  * CVE-2025-13019 (bmo#1988412)
    Same-origin policy bypass in the DOM: Workers component
  * CVE-2025-13013 (bmo#1991945)
    Mitigation bypass in the DOM: Core &amp; HTML component
  * CVE-2025-13020 (bmo#1995686)
    Use-after-free in the WebRTC: Audio/Video component
  * CVE-2025-13014 (bmo#1994241)
    Use-after-free in the Audio/Video component
  * CVE-2025-13015 (bmo#1994164)
    Spoofing issue in Firefox
  * CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
    bmo#1994994)
    Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1763812800">- Mozilla Firefox 145.0.1
  * Fixed: Fixed an issue causing breakage on sites using
    Three.js. (bmo#1995939)
  * Fixed: Fixed Web compatibility issues with Rogers. Rogers
    customers would see a broken iframe with "Firefox Can’t Open
    This Page" when viewing bills, rather than the billing info.
    (bmo#1996823)
  * Fixed: Fixed an issue in the Web Developer Tools preventing
    copy all or save all requests as HAR. (bmo#1995694)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1764158400">- Mozilla Firefox 145.0.2
  * Fixed an issue that prevented typing in Baidu’s search box when
    using Chinese IMEs on Windows. (bmo#2000479)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1764504000">- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765281600">- Mozilla Firefox 146.0
  https://www.firefox.com/en-US/firefox/146.0/releasenotes/
  MFSA 2025-92 (bsc#1254551)
  * CVE-2025-14321 (bmo#1992760)
    Use-after-free in the WebRTC: Signaling component
  * CVE-2025-14322 (bmo#1996473)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2025-14323 (bmo#1996555)
    Privilege escalation in the DOM: Notifications component
  * CVE-2025-14324 (bmo#1996840)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14325 (bmo#1998050)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14326 (bmo#1840666)
    Use-after-free in the Audio/Video: GMP component
  * CVE-2025-14327 (bmo#1970743)
    Spoofing issue in the Downloads Panel component
  * CVE-2025-14328 (bmo#1996761)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14329 (bmo#1997018)
    Privilege escalation in the Netmonitor component
  * CVE-2025-14330 (bmo#1997503)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2025-14331 (bmo#2000218)
    Same-origin policy bypass in the Request Handling component
  * CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
    Memory safety bugs fixed in Firefox 146 and Thunderbird 146
  * CVE-2025-14333 (bmo#1966501, bmo#1997639)
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
    ESR 140.6, Firefox 146 and Thunderbird 146
- requires
  NPSR 4.38.2
  NSS 3.118
  rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1766059200">- Mozilla Firefox 146.0.1
  https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
  MFSA 2025-98 (boo#1255367)
  * CVE-2025-14860 (bmo#2000597)
    Use-after-free in the Disability Access APIs component
  * CVE-2025-14861 (bmo#1996570, bmo#1999700)
    Memory safety bugs fixed in Firefox 146.0.
  * Improved overall stability by fixing crashes related
    to browsing, graphics, and accessibility features.
    (bmo#2001160, bmo#1998185, bmo#1998188)
  * Fixed an issue where fingerprinting protection caused
    incorrect font rendering on popular websites. (bmo#2000429)
  * Fixed crashes related to media playback and GMP process
    shutdown. (bmo#2002697)
  * Fixed an issue where desktop profile shortcuts were being
    unintentionally removed when changing copied profile
    settings. (bmo#1998209)
  * Improved sidebar text contrast when using vertical tabs with
    certain themes. (bmo#2006091)
  * When restoring from a backup, the restore success message will
    appear over the new tab page instead of one of the tabs
    restored from a backup, to avoid cases where the restored tab
    canceled the restore success message. (bmo#2003307)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Firefox 147.0
  https://www.firefox.com/en-US/firefox/147.0/releasenotes
  MFSA 2026-01 (bsc#1256340)
  * CVE-2026-0877 (bmo#1999257)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-0878 (bmo#2003989)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics: CanvasWebGL component
  * CVE-2026-0879 (bmo#2004602)
    Sandbox escape due to incorrect boundary conditions in the
    Graphics component
  * CVE-2026-0880 (bmo#2005014)
    Sandbox escape due to integer overflow in the Graphics
    component
  * CVE-2026-0881 (bmo#2005845)
    Sandbox escape in the Messaging System component
  * CVE-2026-0882 (bmo#1924125)
    Use-after-free in the IPC component
  * CVE-2026-0883 (bmo#1989340)
    Information disclosure in the Networking component
  * CVE-2026-0884 (bmo#2003588)
    Use-after-free in the JavaScript Engine component
  * CVE-2026-0885 (bmo#2003607)
    Use-after-free in the JavaScript: GC component
  * CVE-2026-0886 (bmo#2005658)
    Incorrect boundary conditions in the Graphics component
  * CVE-2026-0887 (bmo#2006500)
    Clickjacking issue, information disclosure in the PDF Viewer
    component
  * CVE-2026-0888 (bmo#1985996)
    Information disclosure in the XML component
  * CVE-2026-0889 (bmo#1999084)
    Denial-of-service in the DOM: Service Workers component
  * CVE-2026-0890 (bmo#2005081)
    Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp; Drop
    component
  * CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
    bmo#2003278)
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
    ESR 140.7, Firefox 147 and Thunderbird 147
  * CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
    bmo#2001081, bmo#2004443)
    Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS &gt;= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1768910400">- Mozilla Firefox 147.0.1
  * Fixed compatibility problems with websites that use the new
    Compression Dictionaries technology, such as ChatGPT, by
    temporarily disabling the feature. (bmo#2010712)
  * Fixed an issue where an unnecessary empty directory was created
    on Linux systems. (bmo#2001887)
  * Fixed an issue where time formats could cause certain
    websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1769601600">- Mozilla Firefox 147.0.2
  * Resolved various issues with missing or impaired browser
    functionality when using XDG Base Directories on Linux. (bmo#2011300)
  * Fixed an issue causing excess passkey prompts to appear when
    logging into some sites. (bmo#2010919)
  * Fixed an issue that could lead to sites being incorrectly
    flagged as malicious by SafeBrowsing. (bmo#2010956)
  MFSA 2026-06 (bsc#1257363)
  * CVE-2026-24868 (bmo#2007302)
    Mitigation bypass in the Privacy: Anti-Tracking component
  * CVE-2026-24869 (bmo#2008698)
    Use-after-free in the Layout: Scrolling and Overflow component</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1770552000">- Mozilla Firefox 147.0.3
  * Interoperability improvements for the CSS anchor positioning
    and Navigation web APIs
  * Fix a regression where `position: sticky` elements on some
    webpages could appear stuck or fail to update while
    mousewheel-scrolling after certain `:hover` interactions
    (bmo#2010481)
  * Fix an issue where the Firefox Developer Tools could fail to
    re-open after using the Inspector’s node picker and reloading
    a page containing cross-origin iframes (bmo#2003810)
  * Fix an issue where the DNS over HTTPS provider settings section
    could appear as a blank box, preventing users from seeing the
    current setting or changing it (bmo#2010501)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771329600">- Mozilla Firefox 147.0.4
  * Fixed an issue that could cause the New Tab Page to appear
    blank for some users (bmo#2014616)
  MFSA 2026-10 (bsc#1258231)
  * CVE-2026-2447 (bmo#2014390)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771848000">- Mozilla Firefox 148.0
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build</changelog>
</package>
<package pkgid="ca0c3f303cab130866003c862ecce1ba3c7e5be799d5e08395b23d5460e3837ab3c97be6bab56defbeca4e7604ae2294dd5f4fdfd3f806ee7c81daf5f27ead64" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="144.0.1" rel="lp161.3.3"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743854400">- Mozilla Thunderbird ESR 128.9.1
  * Added delay to built-in notifications when new profile is
    created in offline mode</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1744718400">- Mozilla Thunderbird ESR 128.9.2
  * Two-factor auth via text or email did not work with Office 365 using Oauth2
  * IRC channel was not visible after restart
  * Global indexing failed when processing email with invalid calendar data
  MFSA 2025-27
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- Mozilla Thunderbird ESR 128.10.0
  * Changed color override defaults with high contrast mode on
    macOS and Linux
  * Using Delete column in "Search Messages..." window could delete
    other messages
  MFSA 2025-32 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="Christian Boltz &lt;suse-beta@cboltz.de&gt;" date="1746964800">- build on s390x needs 17G memory - adjust _constraints</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
</package>
<package pkgid="4c3b134392f7a88196084e7f39c49a9a925330257e23e38b4c72e108db0704764baae2291c7b42b21a9183386244731288136c5508c942e0f53fc4f1d128f959" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="144.0.1" rel="lp161.3.3"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743854400">- Mozilla Thunderbird ESR 128.9.1
  * Added delay to built-in notifications when new profile is
    created in offline mode</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1744718400">- Mozilla Thunderbird ESR 128.9.2
  * Two-factor auth via text or email did not work with Office 365 using Oauth2
  * IRC channel was not visible after restart
  * Global indexing failed when processing email with invalid calendar data
  MFSA 2025-27
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- Mozilla Thunderbird ESR 128.10.0
  * Changed color override defaults with high contrast mode on
    macOS and Linux
  * Using Delete column in "Search Messages..." window could delete
    other messages
  MFSA 2025-32 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="Christian Boltz &lt;suse-beta@cboltz.de&gt;" date="1746964800">- build on s390x needs 17G memory - adjust _constraints</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
</package>
<package pkgid="b265302d8a8b7adf05b426ef0fe3d978fb39e61ce01b0b13cbc6e0f0c0ca2ed254f4adb89f3b6d85b18e18ef934ab0ebbd4703a3cf0034852bf7e865d4d2ef6d" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="148.0.1" rel="lp161.3.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
</package>
<package pkgid="73199fcd3c1ed2a3d3519292db551faff3aeb176315ada66b05282f61f8a02259af36184ca1f7a5a7bf7ac3b755fc703e3105868347a0df0a0a8a9e37d2f3f26" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="148.0.1" rel="lp161.3.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
</package>
<package pkgid="1868c79926d39aee0a453f829d65f53f5b5b1e89939c3d7745d85165beaaeb7e7ac5f6bea64392e595abaf81dacc0fceee0055d601c7a7f0dd34e7c18608c687" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="150.0.2" rel="lp161.3.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774785600">- Mozilla Thunderbird 149.0.1
- requires NSS &gt;= 3.121
- uses Rust 1.93 for build
- removed obsolete patches
  * mozilla-breakpad.patch
  * thunderbird-bmo2006630.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1775390400">- Mozilla Thunderbird 149.0.2</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777377600">- Mozilla Thunderbird 150.0
- added build fixes
  * mozilla-bmo2030493.patch
  * mozilla-bmo2031958.patch
- requires NSS 3.122.1
- use clang on Leap to fix build
- enable profiling for TW</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777464000">- Mozilla Thunderbird 150.0.1
- disable profiling (fails build)
- requires NSS 3.122.2
- removed obsolete mozilla-bmo2031958.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778155200">- Mozilla Thunderbird 150.0.2</changelog>
</package>
<package pkgid="196c358571090a505db83bc12ba80e83b38192487920e3210c5594c9fd103ae6e0fe236244ad8a4a7c1a5049c19c9833d9eea3abe8d4db02545a00bf5791128c" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="150.0.2" rel="lp161.3.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774785600">- Mozilla Thunderbird 149.0.1
- requires NSS &gt;= 3.121
- uses Rust 1.93 for build
- removed obsolete patches
  * mozilla-breakpad.patch
  * thunderbird-bmo2006630.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1775390400">- Mozilla Thunderbird 149.0.2</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777377600">- Mozilla Thunderbird 150.0
- added build fixes
  * mozilla-bmo2030493.patch
  * mozilla-bmo2031958.patch
- requires NSS 3.122.1
- use clang on Leap to fix build
- enable profiling for TW</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777464000">- Mozilla Thunderbird 150.0.1
- disable profiling (fails build)
- requires NSS 3.122.2
- removed obsolete mozilla-bmo2031958.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778155200">- Mozilla Thunderbird 150.0.2</changelog>
</package>
<package pkgid="85fcc951a348f90367d3a1bd3367d3849ebd42c9aa05b8b4e9e2121e468b736eb7e85e099e74b540878b5a7e1bd0e2a863572a0424aae4b8edd246317aab2f84" name="MozillaThunderbird-openpgp-librnp" arch="x86_64">
  <version epoch="0" ver="144.0.1" rel="lp161.3.3"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743854400">- Mozilla Thunderbird ESR 128.9.1
  * Added delay to built-in notifications when new profile is
    created in offline mode</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1744718400">- Mozilla Thunderbird ESR 128.9.2
  * Two-factor auth via text or email did not work with Office 365 using Oauth2
  * IRC channel was not visible after restart
  * Global indexing failed when processing email with invalid calendar data
  MFSA 2025-27
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- Mozilla Thunderbird ESR 128.10.0
  * Changed color override defaults with high contrast mode on
    macOS and Linux
  * Using Delete column in "Search Messages..." window could delete
    other messages
  MFSA 2025-32 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="Christian Boltz &lt;suse-beta@cboltz.de&gt;" date="1746964800">- build on s390x needs 17G memory - adjust _constraints</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
</package>
<package pkgid="be1d9cc8a0a24204eea376d086970c5fdc4b14ec471150a5ab3524961d31359a2ceee92db367606a2a75269dd4d6d78e2563c83905f49d576829468f2b1868f6" name="MozillaThunderbird-openpgp-librnp" arch="x86_64">
  <version epoch="0" ver="148.0.1" rel="lp161.3.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
</package>
<package pkgid="03d1c2cbd5368adf44a00136e114a9ff3dd49b8773c0b646585f49792852bceefc2ee61429c034f11221229e20e41a4a92132bc1cba4245555638297af47a2f0" name="MozillaThunderbird-openpgp-librnp" arch="x86_64">
  <version epoch="0" ver="150.0.2" rel="lp161.3.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774785600">- Mozilla Thunderbird 149.0.1
- requires NSS &gt;= 3.121
- uses Rust 1.93 for build
- removed obsolete patches
  * mozilla-breakpad.patch
  * thunderbird-bmo2006630.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1775390400">- Mozilla Thunderbird 149.0.2</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777377600">- Mozilla Thunderbird 150.0
- added build fixes
  * mozilla-bmo2030493.patch
  * mozilla-bmo2031958.patch
- requires NSS 3.122.1
- use clang on Leap to fix build
- enable profiling for TW</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777464000">- Mozilla Thunderbird 150.0.1
- disable profiling (fails build)
- requires NSS 3.122.2
- removed obsolete mozilla-bmo2031958.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778155200">- Mozilla Thunderbird 150.0.2</changelog>
</package>
<package pkgid="fcc67d72df7149f7fca93dbdbad17815eb0db95ce0d14de3e1911a307fd71385eb4c115255222eaf6e2f57769f8a46882c222851ad6cee3960be701c344b99df" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="144.0.1" rel="lp161.3.3"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743854400">- Mozilla Thunderbird ESR 128.9.1
  * Added delay to built-in notifications when new profile is
    created in offline mode</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1744718400">- Mozilla Thunderbird ESR 128.9.2
  * Two-factor auth via text or email did not work with Office 365 using Oauth2
  * IRC channel was not visible after restart
  * Global indexing failed when processing email with invalid calendar data
  MFSA 2025-27
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- Mozilla Thunderbird ESR 128.10.0
  * Changed color override defaults with high contrast mode on
    macOS and Linux
  * Using Delete column in "Search Messages..." window could delete
    other messages
  MFSA 2025-32 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="Christian Boltz &lt;suse-beta@cboltz.de&gt;" date="1746964800">- build on s390x needs 17G memory - adjust _constraints</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
</package>
<package pkgid="6b1ee628c225a66cbbb2e1c6ff9eca7790ae568eb81247e83634dab3eef9716ea3febce8ecc1f144fc91a4563f37e052c8b5b93a10424ff13a9c1f52ab955143" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="148.0.1" rel="lp161.3.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
</package>
<package pkgid="75fa4cb94796150c9748c8d11c669ae4fdc2b98abae28d56565e7db21261eab7d1441c6fd59038a1f2fc2c98b76c9bf792b9ec0cb73b9a7187c349d729bf1658" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="150.0.2" rel="lp161.3.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774785600">- Mozilla Thunderbird 149.0.1
- requires NSS &gt;= 3.121
- uses Rust 1.93 for build
- removed obsolete patches
  * mozilla-breakpad.patch
  * thunderbird-bmo2006630.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1775390400">- Mozilla Thunderbird 149.0.2</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777377600">- Mozilla Thunderbird 150.0
- added build fixes
  * mozilla-bmo2030493.patch
  * mozilla-bmo2031958.patch
- requires NSS 3.122.1
- use clang on Leap to fix build
- enable profiling for TW</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777464000">- Mozilla Thunderbird 150.0.1
- disable profiling (fails build)
- requires NSS 3.122.2
- removed obsolete mozilla-bmo2031958.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778155200">- Mozilla Thunderbird 150.0.2</changelog>
</package>
<package pkgid="d5d0e18dc87fdb819c14a47aa230bc800acf1d8503c997c87a88e1eba285a9b014cb558f36b3c94168a971285bbfd1a68023c1b1a9e8b7f8fab79f6c0c38feda" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="144.0.1" rel="lp161.3.3"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743854400">- Mozilla Thunderbird ESR 128.9.1
  * Added delay to built-in notifications when new profile is
    created in offline mode</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1744718400">- Mozilla Thunderbird ESR 128.9.2
  * Two-factor auth via text or email did not work with Office 365 using Oauth2
  * IRC channel was not visible after restart
  * Global indexing failed when processing email with invalid calendar data
  MFSA 2025-27
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- Mozilla Thunderbird ESR 128.10.0
  * Changed color override defaults with high contrast mode on
    macOS and Linux
  * Using Delete column in "Search Messages..." window could delete
    other messages
  MFSA 2025-32 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="Christian Boltz &lt;suse-beta@cboltz.de&gt;" date="1746964800">- build on s390x needs 17G memory - adjust _constraints</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
</package>
<package pkgid="fa9b4e6cd284210c756342853d75cf89c546429574cdcf60a8df47e1d7cca94853425548f172b7865faa284beb619d405f4ac1176e4997fce5230e06b45a4ebf" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="148.0.1" rel="lp161.3.4"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747310400">- Mozilla Thunderbird ESR 128.10.1:
  MFSA 2025-34 (boo#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1747828800">- Mozilla Thunderbird ESR 128.10.2
  MFSA 2025-40 (boo#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums
  * Messages could not be viewed if the profile used a UNC path
  * Visual and UX improvements</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1748260800">- Mozilla Thunderbird ESR 128.11.0
  MFSA 2025-46 (boo#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1749384000">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1749470400">- Mozilla Thunderbird ESR 128.11.1
  MFSA 2025-49
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and Credential
    Leakage via mailbox:/// Links</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
</package>
<package pkgid="e4aa3f8d33ad2c9733017ddc7919da5fd098c4da1256623d3f5727d920996f3299bcb3b83892f911df918809b95565fc74c3d9c5a4ea929f335e1105acb1f3fd" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="150.0.2" rel="lp161.3.1"/>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1750161600">- Use these tools/versions unconditionally, package won't build on
  Tumbleweed with new gcc15 otherwise:
  gcc14, gcc14-c++, cargo1.84, rust1.84</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1751198400">- Mozilla Thunderbird ESR 128.12.0
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="Tristan Miller &lt;psychonaut@nothingisreal.com&gt;" date="1752580800">- Mozilla Thunderbird ESR 140.0.1
  MFSA 2025-54
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1961777 bmo#1950056)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377 bmo#1960948 bmo#1966187 bmo#1966505
    bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- adapt mozilla-ntlm-full-path.patch for Thunderbird 140.0.1
- adapt mozilla-silence-no-return-type.patch for Thunderbird
  140.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- Mozilla Thunderbird ESR 140.1.0
  * New folders were not added alphabetically if folders manually
    reordered beforehand
  * Message archive folder creation could silently stop during async
    folder creation
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753531200">- Update memory constraints</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754395200">- Mozilla Thunderbird ESR 140.1.1
  Fixed
  * Users with attachments open in tabs saw an error on Thunderbird restart
  * Sending from unified or local folder failed if no default account was set
  * Delete button could remove attachment instead of message
  * Message list scrolled back when returning to mail tab after opening a message</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1754481600">- Mozilla Thunderbird 141.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757419200">- Mozilla Thunderbird 142.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1757851200">- Mozilla Thunderbird 143.0
- update NSPR and NSS requirements
- drop obsolete mozilla-nongnome-proxies.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1758628800">- Mozilla Thunderbird 143.0.1</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1760356800">- Mozilla Thunderbird 144.0.1
- aligned build constraints with Firefox</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1766491200">- Mozilla Thunderbird 146.0.1
- added mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1768132800">- Mozilla Thunderbird 147.0
- requires NSS &gt;= 3.119
- removed obsolete mozilla-bmo1998188.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772020800">- Mozilla Thunderbird 148.0
- requires NSS &gt;= 3.120.1
- added patches
  thunderbird-bmo2006630.patch
  mozilla-breakpad.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1772884800">- Mozilla Thunderbird 148.0.1
  * LDAP with password stopped working in 148.0</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774785600">- Mozilla Thunderbird 149.0.1
- requires NSS &gt;= 3.121
- uses Rust 1.93 for build
- removed obsolete patches
  * mozilla-breakpad.patch
  * thunderbird-bmo2006630.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1775390400">- Mozilla Thunderbird 149.0.2</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777377600">- Mozilla Thunderbird 150.0
- added build fixes
  * mozilla-bmo2030493.patch
  * mozilla-bmo2031958.patch
- requires NSS 3.122.1
- use clang on Leap to fix build
- enable profiling for TW</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1777464000">- Mozilla Thunderbird 150.0.1
- disable profiling (fails build)
- requires NSS 3.122.2
- removed obsolete mozilla-bmo2031958.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778155200">- Mozilla Thunderbird 150.0.2</changelog>
</package>
<package pkgid="4358dd9624ee083068cefe960ee6ec47e3342cb0b126fa9b43d5cb22e959933c5158627fa0b8dce97a8640972d22f8881234abd1452d7a0361dcd1009e0a2e7a" name="firefox-esr-branding-openSUSE" arch="src">
  <version epoch="0" ver="68" rel="lp161.22.1"/>
  <changelog author="wr@rosenauer.org" date="1445256000">- change homepage to https://www.opensuse.org/searchPage/
  (boo#950948, boo#950949)</changelog>
  <changelog author="wr@rosenauer.org" date="1450440000">- identify Tumbleweed correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1468238400">- Identify the different Leap versions correctly (up to Leap 42.2)
  (boo#987969).</changelog>
  <changelog author="qantas94heavy@gmail.com" date="1481284800">- Fix openSUSE bookmarks not added to default profile (boo#1014292)
  * Move openSUSE bookmarks from toolbar to menu
  * Use local favicon for all bookmarks (Firefox 45+)
  * Fix links to "openSUSE Documentation" and "How to Participate"
    (boo#704121, boo#953164)
- Remove DuckDuckGo search plugin (included upstream)
- Clean up spec file
  * Change $RPM_BUILD_ROOT to %{buildroot}
  * Remove %clean section
  * Escape % symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1493380800">- recognize Leap 42.3 (boo#1036679)</changelog>
  <changelog author="wr@rosenauer.org" date="1496664000">- really fix boo#1036679 (recognize Leap 42.3)</changelog>
  <changelog author="wr@rosenauer.org" date="1522584000">- recognize Leap 15.0 (boo#1087713)</changelog>
  <changelog author="wr@rosenauer.org" date="1535198400">- removed intl.locale.matchOS
  * it's not used in recent versions and it was set in the general
    openSUSE Firefox package since 2011</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1556020800">- bump version to 60 for SLE compatibility (bsc#1128316)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1557057600">- recognize Leap 15 via sle_version (required for &gt;= 15.1)</changelog>
  <changelog author="Lubos Kocman &lt;Lubos.Kocman+factory@suse.de&gt;" date="1563364800">- recognize Leap 15.2 via sle_version</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1568030400">- layout.word_select.stop_at_punctuation -&gt; true (boo#1133163)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1570190400">- removed extensions preferences (moved to core package)
- use multibuild to provide branding package for
  MozillaFirefox and firefox-esr</changelog>
  <changelog author="Stasiek Michalski &lt;stasiek@michalski.cc&gt;" date="1584619200">- Update the default homepage and the bookmark icons</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1632484800">- use HTTPS for software search plugin</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1639742400">- add sle_version 150300 and 150400 check</changelog>
  <changelog author="Rischio Cinico &lt;rischiocinico@gmail.com&gt;" date="1645876800">- add some useful links about openSUSE in the about:newtab page</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1660046400">- add sle_version 150500 check</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1730721600">- add properties to use xdg-desktop-portal (boo#1226112)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1731240000">- do not use XDG for mime-handler as it does not handle the default
  browser check correctly</changelog>
</package>
<package pkgid="436bb0ef07d7ff4255d5223ea2b799be57e217a67e10c3a52b3ea27c70196f97b23d915894adfa9a4659c27ad2f069efb65fc53ee7ffc7419b243a501d479bba" name="firefox-esr-branding-openSUSE" arch="x86_64">
  <version epoch="0" ver="68" rel="lp161.22.1"/>
  <changelog author="wr@rosenauer.org" date="1445256000">- change homepage to https://www.opensuse.org/searchPage/
  (boo#950948, boo#950949)</changelog>
  <changelog author="wr@rosenauer.org" date="1450440000">- identify Tumbleweed correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1468238400">- Identify the different Leap versions correctly (up to Leap 42.2)
  (boo#987969).</changelog>
  <changelog author="qantas94heavy@gmail.com" date="1481284800">- Fix openSUSE bookmarks not added to default profile (boo#1014292)
  * Move openSUSE bookmarks from toolbar to menu
  * Use local favicon for all bookmarks (Firefox 45+)
  * Fix links to "openSUSE Documentation" and "How to Participate"
    (boo#704121, boo#953164)
- Remove DuckDuckGo search plugin (included upstream)
- Clean up spec file
  * Change $RPM_BUILD_ROOT to %{buildroot}
  * Remove %clean section
  * Escape % symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1493380800">- recognize Leap 42.3 (boo#1036679)</changelog>
  <changelog author="wr@rosenauer.org" date="1496664000">- really fix boo#1036679 (recognize Leap 42.3)</changelog>
  <changelog author="wr@rosenauer.org" date="1522584000">- recognize Leap 15.0 (boo#1087713)</changelog>
  <changelog author="wr@rosenauer.org" date="1535198400">- removed intl.locale.matchOS
  * it's not used in recent versions and it was set in the general
    openSUSE Firefox package since 2011</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1556020800">- bump version to 60 for SLE compatibility (bsc#1128316)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1557057600">- recognize Leap 15 via sle_version (required for &gt;= 15.1)</changelog>
  <changelog author="Lubos Kocman &lt;Lubos.Kocman+factory@suse.de&gt;" date="1563364800">- recognize Leap 15.2 via sle_version</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1568030400">- layout.word_select.stop_at_punctuation -&gt; true (boo#1133163)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1570190400">- removed extensions preferences (moved to core package)
- use multibuild to provide branding package for
  MozillaFirefox and firefox-esr</changelog>
  <changelog author="Stasiek Michalski &lt;stasiek@michalski.cc&gt;" date="1584619200">- Update the default homepage and the bookmark icons</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1632484800">- use HTTPS for software search plugin</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1639742400">- add sle_version 150300 and 150400 check</changelog>
  <changelog author="Rischio Cinico &lt;rischiocinico@gmail.com&gt;" date="1645876800">- add some useful links about openSUSE in the about:newtab page</changelog>
  <changelog author="Yuchen Lin &lt;mlin+factory@suse.de&gt;" date="1660046400">- add sle_version 150500 check</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1730721600">- add properties to use xdg-desktop-portal (boo#1226112)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1731240000">- do not use XDG for mime-handler as it does not handle the default
  browser check correctly</changelog>
</package>
<package pkgid="0d37df2360b700fadc99b2df059f3536a1acebfb4d52462d9852e2aad3beec8ce671fecebf862b0ecdf236d4b5418ffbfba69a372ba94b0b01daf62c7c667b86" name="kmozillahelper" arch="src">
  <version epoch="0" ver="5.0.6" rel="lp161.2.1"/>
  <changelog author="fabian@ritter-vogt.de" date="1484568000">- Add initial package</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1484913600">- Update to 4.9.10 to fix build with Leap 42.1</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1484913601">- Update to 4.9.11 to fix default file dialog location and filename</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485259200">- Update to 4.9.12 to implement setting dialogs modal for firefox</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485604800">- Update to 4.9.13 to disallow simultaneous commands from multiple
  firefox windows</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485777600">- Update to 4.9.14 to fix 100% CPU consumption after quitting firefox
  and also handle fake mimetypes for protocols (x-scheme-handler/...)</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485864000">- Update to 4.9.15 to fix the default directory selected in
  file dialogs</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1486555200">- Bump version to 5.0.0, ready for factory submission</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1486814400">- Update to 5.0.1:
  * Fix crash with missing filetype description gh#kmozillahelper/9
  * Fix excessive CPU use in some cases</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1516363200">- Update to 5.0.2:
  * Workaround for file dialogs failing to deliver the result
    under some circumstances</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1544270400">- Update to 5.0.3:
  * Improve HiDPI support
- Add %license</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1563451200">- Update to 5.0.4:
  * Cache helper protocols (boo#1037806)
  * Use new style connect
  * Don't use deprecated KRun:runUrl without flags, use with flags</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1564660800">- Update to 5.0.5:
  * Recognize if started from Thunderbird</changelog>
  <changelog author="Tom Warnke &lt;tom@toromtomtom.com&gt;" date="1594987200">- Supplement not only MozillaFirefox, but also MozillaThunderbird</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1602936000">- Update to 5.0.6:
  * Exclude kmozillahelper from session management (boo#1176852)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1704369600">- BuildRequire rpm_macro(cmake_kf5): we call cmake_kf5 to build and
  thus need to ensure the macro to be known.
- Add extra-cmake-modules BuildRequires: fix build after recent KDE
  Frameworks update.</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1707912000">- Remove rpm_macro(cmake_kf5) BR, not supported on Leap and
  extra-cmke-modules already takes care of that.</changelog>
</package>
<package pkgid="e12d4c891911fa9cfb9ceda7ab46485902b468aa3063f3886d0e9b2ed9db67de791a85e44d94275d890df44e38175a46aeff9c26535566cfee5366055c15aa18" name="kmozillahelper" arch="x86_64">
  <version epoch="0" ver="5.0.6" rel="lp161.2.1"/>
  <changelog author="fabian@ritter-vogt.de" date="1484568000">- Add initial package</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1484913600">- Update to 4.9.10 to fix build with Leap 42.1</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1484913601">- Update to 4.9.11 to fix default file dialog location and filename</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485259200">- Update to 4.9.12 to implement setting dialogs modal for firefox</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485604800">- Update to 4.9.13 to disallow simultaneous commands from multiple
  firefox windows</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485777600">- Update to 4.9.14 to fix 100% CPU consumption after quitting firefox
  and also handle fake mimetypes for protocols (x-scheme-handler/...)</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1485864000">- Update to 4.9.15 to fix the default directory selected in
  file dialogs</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1486555200">- Bump version to 5.0.0, ready for factory submission</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1486814400">- Update to 5.0.1:
  * Fix crash with missing filetype description gh#kmozillahelper/9
  * Fix excessive CPU use in some cases</changelog>
  <changelog author="fabian@ritter-vogt.de" date="1516363200">- Update to 5.0.2:
  * Workaround for file dialogs failing to deliver the result
    under some circumstances</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1544270400">- Update to 5.0.3:
  * Improve HiDPI support
- Add %license</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1563451200">- Update to 5.0.4:
  * Cache helper protocols (boo#1037806)
  * Use new style connect
  * Don't use deprecated KRun:runUrl without flags, use with flags</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1564660800">- Update to 5.0.5:
  * Recognize if started from Thunderbird</changelog>
  <changelog author="Tom Warnke &lt;tom@toromtomtom.com&gt;" date="1594987200">- Supplement not only MozillaFirefox, but also MozillaThunderbird</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1602936000">- Update to 5.0.6:
  * Exclude kmozillahelper from session management (boo#1176852)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1704369600">- BuildRequire rpm_macro(cmake_kf5): we call cmake_kf5 to build and
  thus need to ensure the macro to be known.
- Add extra-cmake-modules BuildRequires: fix build after recent KDE
  Frameworks update.</changelog>
  <changelog author="Fabian Vogt &lt;fabian@ritter-vogt.de&gt;" date="1707912000">- Remove rpm_macro(cmake_kf5) BR, not supported on Leap and
  extra-cmke-modules already takes care of that.</changelog>
</package>
<package pkgid="417b423c67895ef6e9a3309bc2dfb89e8c012b7c0d24f9cde1e6cef325ee21c6b2e54775037d1c12ebc0c4dbfa6bd7e47cd0bd08505e4708c70689de21b6a451" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="55f673d0e446ac3dfdb5ab35c7b6ec46d5efa15386cd6e213c86b831affaca32bde650b915f4b430042ad9a05d37684f80b48cf7afe4af38b1df999a4f110b58" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="cae8d9be1db940f82ce7f110b527b9adee5734fec6d08281f7ed805f7e8a7d71617c487ab93d61df01088427cb02ccc2b162d87005919650c1f1ad2b6124ea82" name="mozilla-nspr" arch="src">
  <version epoch="0" ver="4.39" rel="lp161.2.1"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1571400000">- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="Stasiek Michalski &lt;hellcp@mailbox.org&gt;" date="1573819200">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1578398400">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1626609600">- update to version 4.32
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1628510400">- added a ccache conditional</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1660737600">- update to version 4.34.1
  * add file descriptor sanity checks in the NSPR poll function</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1665921600">- update to version 4.35
  * fixes for building with clang
  * use the number of online processors for the
    PR_GetNumberOfProcessors() API on some platforms
  * fix build on mips+musl libc
  * Add support for the LoongArch 64-bit architecture</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1732536000">- update to version 4.36
  * remove support for OS/2
  * remove support for Unixware, Bsdi, old AIX, old HPUX9 &amp; scoos
  * remove support for Windows 16 bit
  * renamed the prwin16.h header to prwin.h
  * configure was updated from 2.69 to 2.71
  * various build, test and automation script fixes
  * major parts of the source code were reformatted</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- update to version 4.37
  * bmo#1890927 - PR_GetUniqueIdentity asserts on the 32767th call
  * bmo#1880254 - error LNK2019: unresolved external
    symbol _InterlockedCompareExchange
  * bmo#1905990 - initclk deadline elapsed macOS
  * bmo#1921087 - Remove prwin.h (formerly known as prwin16.h)
  * bmo#1939333 - Use builtin atomic functions on RISC-V32/64
  * bmo#1917446 - PR_FormatTimeUSEnglish() doesn't support "%e"
    format specifier</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765108800">- update to version 4.38.2
  * Fixed a syntax error in test file parsetm.c, which was
    introduced in 4.38.1 (bmo#1999381)
  Changes in 4.38.1
  * Incorrect time value produced by PR_ParseTimeString and
    PR_ParseTimeStringToExplodedTime if input string doesn't
    specify seconds. (bmo#1999105)
  Changes in 4.38
  * Removed support for HPUX and _PR_POLL_WITH_SELECT
    (bmo#1965666, bmo#1965916)
  * Fixed a bug in pt_TCP_SendTo on macOS
  * Ensure parameter passed to isalpha() is unsigned char (bmo#375149)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to versoin 4.39
  * Improved error handling in PR_CreateThread on Windows
  * Cleanup and Type-cast fixes for prtime
  * Remove unused prstreams C++ wrapper from NSPR
  * Memory poisoning and Arena redzone fixes
  * Removed emacs/vim modelines and .cvsignore files
  * Added .editorconfig</changelog>
</package>
<package pkgid="cf49f07376109657570b0e3060f3d523e0a8623d15674612ad9d5fbaf6cf05cfceb0c25a6d5336d40b2c5ec04c225589525251eb841361904d17d07bd20bb3b4" name="mozilla-nspr" arch="x86_64">
  <version epoch="0" ver="4.39" rel="lp161.2.1"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1571400000">- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="Stasiek Michalski &lt;hellcp@mailbox.org&gt;" date="1573819200">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1578398400">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1626609600">- update to version 4.32
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1628510400">- added a ccache conditional</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1660737600">- update to version 4.34.1
  * add file descriptor sanity checks in the NSPR poll function</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1665921600">- update to version 4.35
  * fixes for building with clang
  * use the number of online processors for the
    PR_GetNumberOfProcessors() API on some platforms
  * fix build on mips+musl libc
  * Add support for the LoongArch 64-bit architecture</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1732536000">- update to version 4.36
  * remove support for OS/2
  * remove support for Unixware, Bsdi, old AIX, old HPUX9 &amp; scoos
  * remove support for Windows 16 bit
  * renamed the prwin16.h header to prwin.h
  * configure was updated from 2.69 to 2.71
  * various build, test and automation script fixes
  * major parts of the source code were reformatted</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- update to version 4.37
  * bmo#1890927 - PR_GetUniqueIdentity asserts on the 32767th call
  * bmo#1880254 - error LNK2019: unresolved external
    symbol _InterlockedCompareExchange
  * bmo#1905990 - initclk deadline elapsed macOS
  * bmo#1921087 - Remove prwin.h (formerly known as prwin16.h)
  * bmo#1939333 - Use builtin atomic functions on RISC-V32/64
  * bmo#1917446 - PR_FormatTimeUSEnglish() doesn't support "%e"
    format specifier</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765108800">- update to version 4.38.2
  * Fixed a syntax error in test file parsetm.c, which was
    introduced in 4.38.1 (bmo#1999381)
  Changes in 4.38.1
  * Incorrect time value produced by PR_ParseTimeString and
    PR_ParseTimeStringToExplodedTime if input string doesn't
    specify seconds. (bmo#1999105)
  Changes in 4.38
  * Removed support for HPUX and _PR_POLL_WITH_SELECT
    (bmo#1965666, bmo#1965916)
  * Fixed a bug in pt_TCP_SendTo on macOS
  * Ensure parameter passed to isalpha() is unsigned char (bmo#375149)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to versoin 4.39
  * Improved error handling in PR_CreateThread on Windows
  * Cleanup and Type-cast fixes for prtime
  * Remove unused prstreams C++ wrapper from NSPR
  * Memory poisoning and Arena redzone fixes
  * Removed emacs/vim modelines and .cvsignore files
  * Added .editorconfig</changelog>
</package>
<package pkgid="a37b10c092ea10cc75ed8441a4946ac8c4409334c6cfbc97f8989af489fe990b86964552df93b8a57105b01b0804cad7ba2ce803942dbebd57573455f3d2fbb1" name="mozilla-nspr-devel" arch="x86_64">
  <version epoch="0" ver="4.39" rel="lp161.2.1"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1571400000">- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="Stasiek Michalski &lt;hellcp@mailbox.org&gt;" date="1573819200">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1578398400">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1626609600">- update to version 4.32
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1628510400">- added a ccache conditional</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1660737600">- update to version 4.34.1
  * add file descriptor sanity checks in the NSPR poll function</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1665921600">- update to version 4.35
  * fixes for building with clang
  * use the number of online processors for the
    PR_GetNumberOfProcessors() API on some platforms
  * fix build on mips+musl libc
  * Add support for the LoongArch 64-bit architecture</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1732536000">- update to version 4.36
  * remove support for OS/2
  * remove support for Unixware, Bsdi, old AIX, old HPUX9 &amp; scoos
  * remove support for Windows 16 bit
  * renamed the prwin16.h header to prwin.h
  * configure was updated from 2.69 to 2.71
  * various build, test and automation script fixes
  * major parts of the source code were reformatted</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1752926400">- update to version 4.37
  * bmo#1890927 - PR_GetUniqueIdentity asserts on the 32767th call
  * bmo#1880254 - error LNK2019: unresolved external
    symbol _InterlockedCompareExchange
  * bmo#1905990 - initclk deadline elapsed macOS
  * bmo#1921087 - Remove prwin.h (formerly known as prwin16.h)
  * bmo#1939333 - Use builtin atomic functions on RISC-V32/64
  * bmo#1917446 - PR_FormatTimeUSEnglish() doesn't support "%e"
    format specifier</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1765108800">- update to version 4.38.2
  * Fixed a syntax error in test file parsetm.c, which was
    introduced in 4.38.1 (bmo#1999381)
  Changes in 4.38.1
  * Incorrect time value produced by PR_ParseTimeString and
    PR_ParseTimeStringToExplodedTime if input string doesn't
    specify seconds. (bmo#1999105)
  Changes in 4.38
  * Removed support for HPUX and _PR_POLL_WITH_SELECT
    (bmo#1965666, bmo#1965916)
  * Fixed a bug in pt_TCP_SendTo on macOS
  * Ensure parameter passed to isalpha() is unsigned char (bmo#375149)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to versoin 4.39
  * Improved error handling in PR_CreateThread on Windows
  * Cleanup and Type-cast fixes for prtime
  * Remove unused prstreams C++ wrapper from NSPR
  * Memory poisoning and Arena redzone fixes
  * Removed emacs/vim modelines and .cvsignore files
  * Added .editorconfig</changelog>
</package>
<package pkgid="87a9039ed37c43b5a30b16171868aed8d896dcca9dfde1d833f0682033b85b56a328dfb75c779c94f2d20208c9527465d857a050dc92f3369c22edae25b28245" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="935f760f72a40a2cb3ad6cdaad0725aeecf8c81c20beba843c5bca5852694368c7e49017fde2e3f98099e007499efc490f9b0dacb9f4b5f4d0a296fc455d4862" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="579d6550a7ed0cdd369246ee71de7a8df4b811576983b2e3525c286674984c6a6d037bdc8b070deb4d0d81d22750d73c680b881695da83d1703bb7c91b5b1e08" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="cddf5624f32b64cc054867f04e9960bb99dc45eb928ee55a391c03b5674ebab54094fb6e2ccaac99e4fd1917581df62df6ac172ced57c6e59c167ed12fcfab3d" name="mozilla-nss-devel" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="52c8696121b0445500eb5578feeef9beb6881e243611fc18dbd67ddc7e3d25764ede342b5675e386d5a233dc776bf9f9b48fd139c0eff4a36b230927c79e7c15" name="mozilla-nss-sysinit" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="27175b4ecea7690aefb0a845836a6a89f8fcf732a97d112ff3d69a0034d7cddc356d82fb8fc00659245a09a966678fa461e584cde2d80ea1ff6169d8d42ab977" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.124" rel="lp161.7.2"/>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1740916800">- update to NSS 3.108
  * bmo#1923285 - libclang-16 -&gt; libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1741176000">- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
  bad targetKeyLength parameters when checking for FIPS approval
  after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
  RSA signature verification  mechanisms with PKCS padding and
  legacy moduli (bsc#1222834).</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1743336000">- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1745928000">- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1750852800">- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with
    SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in
    sec_asn1d_init_state_based_on_template.
  * bmo#1965754 - update taskgraph to v14.2.1.
  * bmo#1964358 - Workflow for automation of the release on GitHub
    when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or
    CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in
    NSS_CMSMessage_ContainsCertsOrCrls.
  * bmo#1963102 - Remove Cryptofuzz CI version check
- Modify bmo1962556.patch to catch OBS specific errors</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1753099200">- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755518400">- update to NSS 3.115
  * bmo#1970304 - CID 1648399 - Resource leak in shlibsign.c
  * bmo#1981034 - CKA_SEED needs to be marked as a private attribute
  * bmo#1981518 - Fix bad syntax on Windows in softoken_gtest.cc
  * bmo#1974505 - Key private/public/secret keys by key type in softoken keydb
  * bmo#1980990 - add PK11_HPKE_GetSharedSecret to abi-check expected report
  * bmo#1980429 - remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
  * bmo#1927351 - Fixup ABI
  * bmo#1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
  * bmo#1900841 - ECH fuzz target
  * bmo#1965331 - Implement PKCS #11 v3.2 FIPS indicator and validation objects
  * bmo#1978677 - remove expired explicitly distrusted DigiNotar lookalike root
  * bmo#1965329 - Implement PKCS #11 v3.2 functions
- update to NSS 3.114
  * bmo#1977376 - NSS 3.114 source distribution should include NSPR 4.37
  * bmo#1970079 - Prevent leaks during pkcs12 decoding
  * bmo#1953731 - Remove redundant assert in p7local.c
  * bmo#1974515 - Bump nssckbi version to 2.80
  * bmo#1961848 - Remove expired Baltimore CyberTrust Root
  * bmo#1972391 - Add TrustAsia Dedicated Roots to NSS
  * bmo#1974511 - Add SwissSign 2022 Roots to NSS
  * bmo#1836559 - Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects in softoken
  * bmo#1965328 - Implement PKCS #11 v3.2 trust objects - nss proper
  * bmo#1974331 - remove dead code in ssl3con.c
  * bmo#1934867 - DTLS (excl DTLS1.3) Changing Holddown timer logic
  * bmo#1974299 - Bump nssckbi version to 2.79
  * bmo#1967826 - remove unneccessary assertion
  * bmo#1948485 - Update mechanisms for Softoken PCT
  * bmo#1974299 - convert Chunghwa Telecom ePKI Root removal to a distrust after
  * bmo#1973925 - Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
  * bmo#1973930 - use -O2 for asan build
  * bmo#1973187 - Fix leaking locks when toggling SSL_NO_LOCKS
  * bmo#1973105 - remove out-of-function semicolon
  * bmo#1963009 - Extend pkcs8 fuzz target
  * bmo#1963008 - Extend pkcs7 fuzz target
  * bmo#1908763 - Remove unused assignment to pageno
  * bmo#1908762 - Remove unused assignment to nextChunk
  * bmo#1973490 - don't run commands as part of shell `local` declarations
  * bmo#1973490 - fix sanitizer setup
  * bmo#1973187 - don't silence ssl_gtests output when running with coverage
  * bmo#1967411 - Release docs and housekeeping
  * bmo#1972768 - migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1755864000">- update to NSS 3.115.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838400">- update to NSS 3.116
  * bmo#1983308 - disable DSA in NSS script tests
  * bmo#1983308 - Disabling of some algorithms: generic cert.sh
  * bmo#1981046 - Need to update to new mechanisms
  * bmo#1983320 - Add ML-DSA public key printing support in NSS command-line utilities
  * bmo#1986802 - note embedded scts before revocation checks are performed
  * bmo#1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface
  * bmo#1983320 - Add support for ML-DSA key type and public key structure
  * bmo#1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag
  * bmo#1983308 - disable kyber
  * bmo#1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature)
  * bmo#1983308 - Disable dsa - gtests
  * bmo#1983313 - make group and scheme support in test tools generic
  * bmo#1983770 - Create GH workflow to automatically close PRs
  * bmo#1983308 - Disable dsa - base code
  * bmo#1983308 - Disabling of some algorithms: remove dsa from pk11_mode
  * bmo#1983308 - Disable seed and RC2 bug fixes
  * bmo#1982742 - restore support for finding certificates by decoded serial number
  * bmo#1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups
  * bmo#1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
  * bmo#1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1759838401">- update to NSS 3.117
  * bmo#1992218 - fix memory leak in secasn1decode_unittest.cc
  * bmo#1988913 - Add OISTE roots
  * bmo#1976051 - Add runbook for certdata.txt changes
  * bmo#1991666 - dbtool: close databases before shutdown
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  * bmo#1956754 - don’t flush base64 when buffer is null
  * bmo#1989541 - Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
  * bmo#1989480 - mozilla::pkix: recognize the qcStatements extension for QWACs
  * bmo#1980465 - Fix a big-endian-problematic cast in zlib calls
  * bmo#1962321 - Revert removing out/ directory after ossfuzz build
  * bmo#1988524 - Add Cryptofuzz to OSS-Fuzz build
  * bmo#1984704 - Add PKCS#11 trust tests
  * bmo#1983308 - final disable dsa patch cert.sh
  * bmo#1983320 - ml-dsa: move tls 1.3 to use streaming signatures
  * bmo#1983320 - ml-dsa: Prep Create a FindOidTagByString function
  * bmo#1983320 - ml-dsa: softoken changes
  * bmo#1983320 - ml-dsa: der key decode
  * bmo#1983320 - ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
  * bmo#1983320 - ml-dsa: Prep Create a CreateSignatureAlgorithmID function</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1763640000">- update to NSS 3.118.1
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
  * bmo#1994866 - Remove four Commscope root certificates from NSS
  * bmo#1996036 - fix try pushes with --nspr-patch to actually apply the patch
  * bmo#1995512 - Support for NIST Curves compressed points
  * bmo#1985058 - Destroy certificate on error paths
  * bmo#1990242 - Move NSS DB password hash away from SHA-1
  * bmo#1983313 - support secp384r1mlkem1024
  * bmo#1991549 - vendor latest ML-KEM code from libcrux
  * bmo#1991549 - add mlk-kem-1024 tests
  * bmo#1996717 - use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
  * bmo#1766767 - Move scripts to python3
  * bmo#1983313 - add mlkem1024 support in freebl
  * bmo#1983313 - support secp256r1mlkem768
  * bmo#1983313 - Make mlkem768x25519 the default
  * bmo#1983320 - ML-DSA SGN and VFY interfaces
  * bmo#1988625 - Align FIPS interfaces count with array
  * bmo#1989477 - Ensure CKK_ML_KEM has derive CK_FALSE
  * bmo#1992128 - Add script for tagging an NSS release
  * bmo#1992128 - Remove the globals from nss-release-helper.py
  * bmo#1992128 - Add release helper command for generating the release index
  * bmo#1992128 - Add release helper command for generating a release note
  * bmo#1992128 - Add release helper command for freezing a branch</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1765886400">- update to NSS 3.119.1
  * bmo#2004866 - restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
  * bmo#1983320 - Fix ml-dsa return value for  SECKEY_PrivateKeyStrengthInBits.
  * bmo#1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
  * bmo#2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
  * bmo#2003314 - handle errors while setting sanitizers cflags in build.
  * bmo#1986912 - Ignore IVs for AES KW.
  * bmo#2003286 - Update Cryptofuzz version.
  * bmo#2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
  * bmo#1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
  * bmo#1999204 - fix CPU_ARCH setting for arm64 makefile builds.
  * bmo#1998094 - remove unused calcThreads variable from cmd/rsaperf.
  * bmo#1978348 - Solving the incorrect tests introduced by extending EKU.
  * bmo#1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
  * bmo#1978348 - Extending parsing with Microsoft Document Signing EKU.
  * bmo#1978348 - Extending parsing with Adobe Document Signing EKU.
  * bmo#1978348 - Extending pkix parsing with document signing EKUs.
  * bmo#2000737 - fix compilation failure on ia32.
  * bmo#2000737 - use hardware x64 GCM in static builds.
  * bmo#2000737 - separate ppc sha512 library from ppc gcm library.
  * bmo#2000737 - simplify cross-compilation from build.sh.
  * bmo#1724353 - use clang's integrated assembler.
  * bmo#2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
  * bmo#2000737 - fix logic for disabling altivec in gyp builds.
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1972825 - Add TLS interoperability tests with openssl and gnutls.
  * bmo#1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
  * bmo#1965329 - add failure checks to pk11_mergeTrust() .
  * bmo#1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1768219200">- update to NSS 3.120
  * bmo#2008768 - Fix docs generation bug.
  * bmo#2007908 - CID 1678226: Dereferencing null pointer plaintext.data().
  * bmo#2004694 - Run PKCS12 fuzz target with --fuzz=tls in CI.
  * bmo#1978603 - Allowing RT be started several times.
  * bmo#2005751 - move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1771761600">- update to NSS 3.120.1
  * no upstream releasenotes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1774267200">- update to NSS 3.121
  * bmo#2017366 - update vendored zlib to v1.3.2.
  * bmo#2012645 - Revert the unnecessary changes to intel-gcm-wrap.gyp.
  * bmo#2012645 - Use C fallback for AES-GCM on MinGW builds.
  * bmo#2005669 - fix ML-KEM PCT.
  * bmo#2017008 - Extend NSS Fuzzing docs.
  * bmo#2009552 - avoid integer overflow in platform-independent ghash.
  * bmo#2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname.
  * bmo#2012313 - fix build with glibc-2.43 assignment discards 'const'
    qualifier from pointer.
  * bmo#2013188 - add gcm.gyp dependency for Solaris SPARC builds.
  * bmo#2010389 - Set nssckbi version to 2.84.
  * bmo#2010389 - Add e-Szigno TLS Root CA 2023 to NSS.
  * bmo#2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64
    in coreconf/Darwin.mk.
  * bmo#2009998 - Update cryptofuzz version.
  * bmo#2001167 - Paranoia assert.
  * bmo#2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S.
  * bmo#2000737 - rename intel-{aes,gcm}.s to .S.
  * bmo#2000737 - rename C files for platform-specific ghash implementations.
  * bmo#2000737 - simplify compilation of platform-specific GCM and GHASH.
  * bmo#2007911 - FORWARD_NULL null deref of worker in p7decode.c
    (sec_pkcs7_decoder_abort_digests).
  * bmo#2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing
    (zero-length privateKey).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1774440000">- update to NSS 3.122
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023664 - run mach doc-lint from generate_release_doc.py.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
  * bmo#2021911 - fix cipher spec count intermittent CI failures.
  * bmo#2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
  * bmo#2023437 - lint the legacy documentation.
  * bmo#2023437 - lint the NSS 3.112.3 release notes.
  * bmo#2023437 - add a doc-lint CI job.
  * bmo#2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
  * bmo#1472747 - wrong alert for malformed TLS 1.3 Finished.
  * bmo#1916429 - Swap order of asserts and state check.
  * bmo#2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
  * bmo#2017929 - GCM needs to check for various limits in FIPS mode.
  * bmo#2017938 - Get Key Length not working from ED and Montgomery keys.
  * bmo#2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
  * bmo#2020721 - fix intermittent ssl.sh test failures on windows runners.
  * bmo#2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
  * bmo#2017920 - Generate keys not getting indicators.
  * bmo#2020612 - improve error handling in smime_init_once.
  * bmo#1987288 - Detect CPU features on OpenBSD using elf_aux_info.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
  * bmo#2019194 - fix missing .S file error in Solaris Makefile builds.
  * bmo#2020486 - fix memory leak in NSC_GenerateKey error path.
  * bmo#2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
  * bmo#2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
  * bmo#2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
  * bmo#2020188 - avoid null deref in mp_div_d sign normalization.
  * bmo#2017945 - Temp private key lifecycle is broken.
  * bmo#1851073 - protect rwSessionCount with slotLock.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1828713 - Fix intermittent ClientGreaseKeyShare test failure.
  * bmo#2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
  * bmo#2019760 - patch upstream acvp-rust during checkout to avoid build failures.
  * bmo#2019760 - update acvp Dockerfile.
  * bmo#2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
  * bmo#2018000 - CKA_SEED missing from isPrivate in the database.
  * bmo#2019717 - update abicheck expectation for __nss_InitLock.
  * bmo#2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
  * bmo#2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
  * bmo#2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
  * bmo#2019327 - tests: add native_path helper for cross-platform path conversion.
  * bmo#2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
  * bmo#2019090 - avoid platform GCM for x64 iOS emulator builds.
  * bmo#2012002 - remove lock instrumentation feature.
  * bmo#2017923 - Move FIPS indicator structures out of fips_algorithms.h.
  * bmo#2018064 - all.sh is failing in FIPS SSL test in main tree.
  * bmo#1975973 - fix memory leaks in crmf tests.
  * bmo#2012547 - fix unsatisfiable condition in lg_getTrust.
  * bmo#2006218 - allow selfserv makefile build to use system zlib.
  * bmo#2002247 - Add allocation limit to pkcs12 decoding.
  * bmo#2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
  due to upstreamed FIPS patches</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1776168000">- update to NSS 3.122.1
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#1935995 - make ss-&gt;ssl3.hs.cookie an owned-copy of the cookie.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1777377600">- update to NSS 3.122.2:
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1778846400">- update to NSS 3.123.1
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without
    capping ss-&gt;vrange.max
- update to NSS 3.123
  * https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- disabled FIPS patches temporarily (need significant rebasing)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1781265600">- update to NSS 3.124
  * bmo#2032562 - Add test for PKCS7 digest array alignment.
  * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
  * bmo#2030994 - Add test for CMS content size validation.
  * bmo#2030995 - Add regression tests for DSAU signature decoding.
  * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
  * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
  * bmo#2019233 - Add test for intra-arena ASan redzones.
  * bmo#2033058 - update nss_status flags one at a time.
  * bmo#2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
  * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
  * bmo#2020596 - add runtime check on decoded resumption token session id.
  * bmo#2035882 - improve mach try error handling.
  * bmo#2030798 - clang format.
  * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
  * bmo#2033058 - add bugzilla_cf_status_nss.py script.
  * bmo#2033057 - regenerate some recent release notes.
  * bmo#2033057 - fix bug list output by release note and email scripts.
  * bmo#2031190 - test removal from trust domain email cache.
  * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
  * bmo#2035348 - build sqlite3 shell for Windows CI runners.
  * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
  * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
  * bmo#2034258 - add CLAUDE.md and .mcp.json.
  * bmo#2034244 - add a mach try command.
  * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
  * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
  * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
  * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
  * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
  * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
  * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
  * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss-&gt;vrange.max.
  * bmo#2034157 - set previous-nss-release for abicheck.
  * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
  * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
  * bmo#2030985 - Remove CRMF from testing and manifests.
  * bmo#2026711 - Remove unused RSA blind signature implementation from freebl</changelog>
</package>
<package pkgid="ec8b6719299cf25095e48177946dc70f0f82b5a673b5beadfdaa7f49b5cc92ae20425a488c451e4a20031315bd8778fef6468052f990e9a1e09c2c63dc9d979c" name="rust-cbindgen" arch="src">
  <version epoch="0" ver="0.29.4+git0" rel="lp161.64.1"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1618833600">- Update to 0.19.0
  * Simplify types in generics
  * Use --profile=check for macro expansion
  * Use exported name to prefix enum variants
  * Fix path attribute handling in inline submodules
  * Fix a stack overflow with some recursive typedefs
- Update to 0.18.0
  * Simplify types in nested types such as pointed-to types and
    function signatures
- Update to 0.17.0
  * Add with_parse_extra_bindings to builder.
  * Support NonZero and fix incorrect simplification of Option&lt;ptr&gt; into ptr.
  * Deal with name conflicts correctly in declaration type resolution.
  * Support pointers to ZSTs.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to to build from _service with cargo-audit integration</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1623240000">- Resolve issue with UPDATING.md in submission</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1624276800">- Remove unnecessary dependency on rust-std-static (implied by rust)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1625486400">- Update vendored dependencies to resolve potential memory corruption
  in dependency ( RUSTSEC-2021-0003 )</changelog>
  <changelog author="william.brown@suse.com" date="1627646400">- Update to version 0.20.0+git0:
  * v0.20.0
  * Don't use `check` profile when expanding code on a release build
  * Update --pretty=expanded to -Zunpretty=expanded
  * Fix some clippy lints.
  * Simplify Pin&lt;T&gt; to T
  * add `Builder::with_using_namespaces`
  * Ignore PhantomPinned
  * Move the target-guessing code from #676 to its own function.
  * Only fetch dependencies for current platform by default (#676)
  * v0.19.0</changelog>
  <changelog author="william.brown@suse.com" date="1648382400">- Update to version 0.21.0+git0:
  * v0.21.0
  * Update MSRV to 1.54.0
  * Update clap to 3.1
  * Update heck to 0.4.0
  * Remove etesync from readme.
  * Update docs.md
  * Remove wgpu-native from users.
  * Address clippy lint.
  * unraw the identifiers
  * Silence some dead_code warnings.</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1649160000">- Automatic update of vendored dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1650456000">- Update to version 0.22.0+git0:
  * v0.22.0
  * Support rename rule for union body members.
  * constant: Add support for other expressions WebRender uses.
  * constant: Add support for associated constant expressions.
  * Fix regression in CamelCase rename rule (should be lowerCamelCase)
  * enumeration: simplify standard types in variants.
  * Avoid generating and writing bindings when called recursively
  * Cython: Omit per-variant tags in unions generated for Rust enums
  * Update various dependencies.
  * v0.21.0</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- Update to version 0.23.0+git0:
  * v0.23.0
  * constant: Make const.allow_constexpr default to true.
  * constant: Allow more constexpr constants.
  * Update syn dependency to at least 1.0.88
  * Fix #753</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Update to version 0.24.2+git0:
  * Version bump.
  * bitflags: Be explicit in binary operators and such.
  * Version bump.
  * constant: Add support for unary negation.
  * bitflags: Make more operations constexpr.
  * Fix changelog typo.
  * Version bump.
  * constant: Support suffixes for integers that otherwise would be narrowed.
  * Fix specialization of `SomeType&lt;N&gt;` when `N` is a const parameter.
  * Minor refactor of ConstExpr::load().</changelog>
  <changelog author="wolfgang@rosenauer.org" date="1658923200">- Update to version 0.24.3+git0:
  * Bump version.
  * tests: Add a test for struct constants going through typedefs.
  * bindings: Peel through typedefs for struct constant generation.
  * Rustfmt recent changes.
  * Version bump.
  * bitflags: Be explicit in binary operators and such.
  * Version bump.
  * constant: Add support for unary negation.
  * bitflags: Make more operations constexpr.
  * Fix changelog typo.</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- Update to version 0.24.3+git0:
  * Bump version.
  * tests: Add a test for struct constants going through typedefs.
  * bindings: Peel through typedefs for struct constant generation.
  * Rustfmt recent changes.
  * Version bump.
  * bitflags: Be explicit in binary operators and such.
  * Version bump.
  * constant: Add support for unary negation.
  * bitflags: Make more operations constexpr.
  * Fix changelog typo.</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1689076801">- Automatic update of vendored dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1693828800">- Update to version 0.25.0+git0:
  * Fix minimal Rust version in CI
  * Revert "Upgrade clap 3 to clap 4"
  * Fix clippy warning
  * Fix CI
  * Update changelog for v0.25.0
  * CI: Replace forbidden actions with cli code
  * CI: Add semver checks to CI deploy job
  * msrv 1.64
  * Upgrade clap 3 to clap 4
  * Add: Add rust-toolchain.toml</changelog>
  <changelog author="william.brown@suse.com" date="1694606400">- Update to version 0.26.0+git0:
  * v0.26.0
  * Update MSRV in Readme
  * Add support for out-of-line bitfields declarations
  * Update URLs
  * Bump clippy msrv to 1.64
  * Handle bitflags bits method calls
  * CHANGES: Note #[deprecated] support.
  * utilities: annotation: Clean-up deprecated parsing and getter.
  * Add support for #[deprecated].
  * Support "C-unwind" ABI</changelog>
  <changelog author="william.brown@suse.com" date="1738670400">- Update to version 0.28.0+git0:
  * Release 0.28.0
  * tests: Fix symbol file and tests.
  * Appease clippy.
  * tests: Run rustfmt.
  * Add a way to generate a list of symbols for dynamic linkage, resolves #907
  * Add `unstable_ir` feature flag that makes the ir pub
  * Refactor arm64 build to matrix strategy
  * Add aarch64/arm64 to CI
  * Fix clippy warnings
  * newlines for constexpr
  * replace is_first_field to enumerate
  * Fix: avoid potential race in tests/profile.rs
  * Fix: Ignore `CARGO_BUILD_TARGET` in lib tests too
  * Fix: Ignore `CARGO_BUILD_TARGET` in tests
  * Add a test for mangling of array generics.
  * Implement mangling for arrays
  * ir: add support for UnsafeCell and SyncUnsafeCell
  * rename: Add a test for rename-all=prefix:
  * Less clone for rename-all.
  * Add rename-all=prefix:
  * Fix local override of enum prefix-with-name
  * Also update syn in the Cargo.toml.
  * utilities: Minor clean-up.
  * Parse `unsafe` attributes
  * Deduplicate the code that turns transparent structs into typedefs
  * Bump MSRV again for clap.
  * Cargo update and version bump.
  * Update CHANGES since v0.26.0
  * Output condition for globals.
  * Add missing parens to log message
  * Update cython expectations from the previous patch.
  * Fix variadic arguments when used in function pointer
  * deps: Update syn to 2.0
  * Generalize Item to expose documentation and generic params
  * Used documented method of specifying variadic arguments `va_list` -&gt; `...` * https://en.cppreference.com/w/c/language/variadic * https://en.cppreference.com/w/cpp/language/variadic_arguments
  * Parse function argument type first so it can be used to determine name
  * Improved test coverage of va_list
  * Point out issue with failing builds due to syntax errors
  * Add support for NonZero&lt;T&gt; and simplify handling of int primitives
  * support generics with defaulted args
  * handle constants of nested transparent types
  * make it a dev dependency only
  * tests use pretty_assertions for readable diffs
  * chore: Update dependencies.
  * revert accidentally committed debug code
  * Exclude all test crates
  * Exclude test depfile crates
  * Rename duplicate crates in workspace
  * bug fixed, update test and expectations
  * add panic to check whether parser even sees it
  * Expand ignored.rs test to cover associated items
  * chore: Fix clippy lints.
  * Fix cpplint warnings
  * Add `cpp_compat` to template.toml
  * parser: Treat omitted ABI in extern block as "C".
  * Account for cfg items in foreign mods.
  * bindgen: More language-backend clean-up.
  * Remove code duplication for function writing, and other minor clean-ups.
  * introduce the concept of language backend
  * ir: Write documentation on static items.
  * Run CI jobs on the merge queue.
  * Added support for integrating the package_version information in a comment of the header file.
  * feat: support #[deprecated] on enum variants
  * Use `retain` in `ItemMap::filter`
  * fix: select package for bindgen based on name and manifest path
  * Update README.md
  * Update doc link in Readme so it works from docs.rs
  * Quote envvar to match documentation
  * ci: Use GITHUB_OUTPUT envvar instead of set-output command
  * Bump Serial-test
  * Update clap further
  * Update dependencies and bump MSRV to 1.70
  * Fix clippy warning
  * Fix clap 4 update.
  * Upgrade clap 3 to clap 4
  * Fix `..Default::default()` for struct `Config`
  * Add docs for no-export</changelog>
  <changelog author="william.brown@suse.com" date="1763726400">- Update to version 0.29.2+git0:
  * Explicitly request serde's std features to avoid issues with newer toml versions.
  * Account for master -&gt; main rename.
  * Update changelog and bump version.
  * enum: Track dependencies properly in enumerations.
  * Allow must_use if a reason is specified
  * constant: Handle cfg in associated constants.
  * tests: Add a test for bitflags + disjoint cfg.
  * Remove "display" feature from the toml crate
  * DOC: Add metatensor
  * Fix #1085 - Incorrect detection of duplicated constants
  * chore: More clippy fixes.
  * docs: Correct after_include type in example config
  * cargo update
  * cfg: Remove another clippy warning.
  * Fix `clippy::uninlined_format_args`
  * Update toml to 0.9
  * Release 0.29.0
  * Support no-export annotation for statics and functions.
  * conditional fields of constexpr literal structs
  * Add LiteralStructField
  * Github action: Add aarch64 to deploy
  * Add rename rule for generated associated constant
  * Upgrade heck to 0.5
  * Add support for an optional nullable attribute
  * docs.md: Fix deprecated_with_note and deprecated_variant_with_note being spelled as 'notes'
  * Fix generic with "void" default
  * The return of Cast is simplified
  * Added tests for as keyword inside array into structs
  * Fixed error generation of structures using the keyword of as inside arrays
  * Added test for unsafe(no_mangle) attribute
  * Added tests for unsafe methotd's atributs
  * Fixed handling of trait methods containing the unsafe attribute
  * Rename -Zparse-only
  * Release 0.28.0
  * tests: Fix symbol file and tests.
  * Appease clippy.
  * tests: Run rustfmt.</changelog>
  <changelog author="william.brown@suse.com" date="1775044800">- Update to version 0.29.2+git0:
  * ci: Add a meta job to block the merge queue on it.
  * Check for CMSE ABI's as well
  * Fix doc attribute parsing to properly handle block comments
  * Expose the line_endings config option to use with the builder
  * fix env in workflow file
  * use env to pass output parameters
  * Explicitly request serde's std features to avoid issues with newer toml versions.
  * Account for master -&gt; main rename.
  * Update changelog and bump version.
  * enum: Track dependencies properly in enumerations.</changelog>
  <changelog author="william.brown@suse.com" date="1781265600">- Update to version v0.29.4+git0:
  * Bump version.
  * tests: Add some tests for constant enums.
  * ir: Add support for arrays.
  * ir: Allow constant literals with enum variants.
  * ir: Use Path for ConstExprs.
  * Bump version to 0.29.3 and update CHANGES doc
  * tests: Fix tests with modern gcc.
  * Use C++ fixed-type enumeration syntax under C23 (or higher) as well
  * Allow `pub` access to `ReprType` fields</changelog>
</package>
<package pkgid="b9ad29400c0afa592b943fcf778079ffb3c41f9e07f29f3c9e3574859309d3620565e64504cda14b8f5c94929f10e42922590a3cd7cfa1b51f1714f9980c0438" name="rust-cbindgen" arch="x86_64">
  <version epoch="0" ver="0.29.4+git0" rel="lp161.64.1"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1618833600">- Update to 0.19.0
  * Simplify types in generics
  * Use --profile=check for macro expansion
  * Use exported name to prefix enum variants
  * Fix path attribute handling in inline submodules
  * Fix a stack overflow with some recursive typedefs
- Update to 0.18.0
  * Simplify types in nested types such as pointed-to types and
    function signatures
- Update to 0.17.0
  * Add with_parse_extra_bindings to builder.
  * Support NonZero and fix incorrect simplification of Option&lt;ptr&gt; into ptr.
  * Deal with name conflicts correctly in declaration type resolution.
  * Support pointers to ZSTs.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to to build from _service with cargo-audit integration</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1623240000">- Resolve issue with UPDATING.md in submission</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1624276800">- Remove unnecessary dependency on rust-std-static (implied by rust)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1625486400">- Update vendored dependencies to resolve potential memory corruption
  in dependency ( RUSTSEC-2021-0003 )</changelog>
  <changelog author="william.brown@suse.com" date="1627646400">- Update to version 0.20.0+git0:
  * v0.20.0
  * Don't use `check` profile when expanding code on a release build
  * Update --pretty=expanded to -Zunpretty=expanded
  * Fix some clippy lints.
  * Simplify Pin&lt;T&gt; to T
  * add `Builder::with_using_namespaces`
  * Ignore PhantomPinned
  * Move the target-guessing code from #676 to its own function.
  * Only fetch dependencies for current platform by default (#676)
  * v0.19.0</changelog>
  <changelog author="william.brown@suse.com" date="1648382400">- Update to version 0.21.0+git0:
  * v0.21.0
  * Update MSRV to 1.54.0
  * Update clap to 3.1
  * Update heck to 0.4.0
  * Remove etesync from readme.
  * Update docs.md
  * Remove wgpu-native from users.
  * Address clippy lint.
  * unraw the identifiers
  * Silence some dead_code warnings.</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1649160000">- Automatic update of vendored dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1650456000">- Update to version 0.22.0+git0:
  * v0.22.0
  * Support rename rule for union body members.
  * constant: Add support for other expressions WebRender uses.
  * constant: Add support for associated constant expressions.
  * Fix regression in CamelCase rename rule (should be lowerCamelCase)
  * enumeration: simplify standard types in variants.
  * Avoid generating and writing bindings when called recursively
  * Cython: Omit per-variant tags in unions generated for Rust enums
  * Update various dependencies.
  * v0.21.0</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- Update to version 0.23.0+git0:
  * v0.23.0
  * constant: Make const.allow_constexpr default to true.
  * constant: Allow more constexpr constants.
  * Update syn dependency to at least 1.0.88
  * Fix #753</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Update to version 0.24.2+git0:
  * Version bump.
  * bitflags: Be explicit in binary operators and such.
  * Version bump.
  * constant: Add support for unary negation.
  * bitflags: Make more operations constexpr.
  * Fix changelog typo.
  * Version bump.
  * constant: Support suffixes for integers that otherwise would be narrowed.
  * Fix specialization of `SomeType&lt;N&gt;` when `N` is a const parameter.
  * Minor refactor of ConstExpr::load().</changelog>
  <changelog author="wolfgang@rosenauer.org" date="1658923200">- Update to version 0.24.3+git0:
  * Bump version.
  * tests: Add a test for struct constants going through typedefs.
  * bindings: Peel through typedefs for struct constant generation.
  * Rustfmt recent changes.
  * Version bump.
  * bitflags: Be explicit in binary operators and such.
  * Version bump.
  * constant: Add support for unary negation.
  * bitflags: Make more operations constexpr.
  * Fix changelog typo.</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- Update to version 0.24.3+git0:
  * Bump version.
  * tests: Add a test for struct constants going through typedefs.
  * bindings: Peel through typedefs for struct constant generation.
  * Rustfmt recent changes.
  * Version bump.
  * bitflags: Be explicit in binary operators and such.
  * Version bump.
  * constant: Add support for unary negation.
  * bitflags: Make more operations constexpr.
  * Fix changelog typo.</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1689076801">- Automatic update of vendored dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1693828800">- Update to version 0.25.0+git0:
  * Fix minimal Rust version in CI
  * Revert "Upgrade clap 3 to clap 4"
  * Fix clippy warning
  * Fix CI
  * Update changelog for v0.25.0
  * CI: Replace forbidden actions with cli code
  * CI: Add semver checks to CI deploy job
  * msrv 1.64
  * Upgrade clap 3 to clap 4
  * Add: Add rust-toolchain.toml</changelog>
  <changelog author="william.brown@suse.com" date="1694606400">- Update to version 0.26.0+git0:
  * v0.26.0
  * Update MSRV in Readme
  * Add support for out-of-line bitfields declarations
  * Update URLs
  * Bump clippy msrv to 1.64
  * Handle bitflags bits method calls
  * CHANGES: Note #[deprecated] support.
  * utilities: annotation: Clean-up deprecated parsing and getter.
  * Add support for #[deprecated].
  * Support "C-unwind" ABI</changelog>
  <changelog author="william.brown@suse.com" date="1738670400">- Update to version 0.28.0+git0:
  * Release 0.28.0
  * tests: Fix symbol file and tests.
  * Appease clippy.
  * tests: Run rustfmt.
  * Add a way to generate a list of symbols for dynamic linkage, resolves #907
  * Add `unstable_ir` feature flag that makes the ir pub
  * Refactor arm64 build to matrix strategy
  * Add aarch64/arm64 to CI
  * Fix clippy warnings
  * newlines for constexpr
  * replace is_first_field to enumerate
  * Fix: avoid potential race in tests/profile.rs
  * Fix: Ignore `CARGO_BUILD_TARGET` in lib tests too
  * Fix: Ignore `CARGO_BUILD_TARGET` in tests
  * Add a test for mangling of array generics.
  * Implement mangling for arrays
  * ir: add support for UnsafeCell and SyncUnsafeCell
  * rename: Add a test for rename-all=prefix:
  * Less clone for rename-all.
  * Add rename-all=prefix:
  * Fix local override of enum prefix-with-name
  * Also update syn in the Cargo.toml.
  * utilities: Minor clean-up.
  * Parse `unsafe` attributes
  * Deduplicate the code that turns transparent structs into typedefs
  * Bump MSRV again for clap.
  * Cargo update and version bump.
  * Update CHANGES since v0.26.0
  * Output condition for globals.
  * Add missing parens to log message
  * Update cython expectations from the previous patch.
  * Fix variadic arguments when used in function pointer
  * deps: Update syn to 2.0
  * Generalize Item to expose documentation and generic params
  * Used documented method of specifying variadic arguments `va_list` -&gt; `...` * https://en.cppreference.com/w/c/language/variadic * https://en.cppreference.com/w/cpp/language/variadic_arguments
  * Parse function argument type first so it can be used to determine name
  * Improved test coverage of va_list
  * Point out issue with failing builds due to syntax errors
  * Add support for NonZero&lt;T&gt; and simplify handling of int primitives
  * support generics with defaulted args
  * handle constants of nested transparent types
  * make it a dev dependency only
  * tests use pretty_assertions for readable diffs
  * chore: Update dependencies.
  * revert accidentally committed debug code
  * Exclude all test crates
  * Exclude test depfile crates
  * Rename duplicate crates in workspace
  * bug fixed, update test and expectations
  * add panic to check whether parser even sees it
  * Expand ignored.rs test to cover associated items
  * chore: Fix clippy lints.
  * Fix cpplint warnings
  * Add `cpp_compat` to template.toml
  * parser: Treat omitted ABI in extern block as "C".
  * Account for cfg items in foreign mods.
  * bindgen: More language-backend clean-up.
  * Remove code duplication for function writing, and other minor clean-ups.
  * introduce the concept of language backend
  * ir: Write documentation on static items.
  * Run CI jobs on the merge queue.
  * Added support for integrating the package_version information in a comment of the header file.
  * feat: support #[deprecated] on enum variants
  * Use `retain` in `ItemMap::filter`
  * fix: select package for bindgen based on name and manifest path
  * Update README.md
  * Update doc link in Readme so it works from docs.rs
  * Quote envvar to match documentation
  * ci: Use GITHUB_OUTPUT envvar instead of set-output command
  * Bump Serial-test
  * Update clap further
  * Update dependencies and bump MSRV to 1.70
  * Fix clippy warning
  * Fix clap 4 update.
  * Upgrade clap 3 to clap 4
  * Fix `..Default::default()` for struct `Config`
  * Add docs for no-export</changelog>
  <changelog author="william.brown@suse.com" date="1763726400">- Update to version 0.29.2+git0:
  * Explicitly request serde's std features to avoid issues with newer toml versions.
  * Account for master -&gt; main rename.
  * Update changelog and bump version.
  * enum: Track dependencies properly in enumerations.
  * Allow must_use if a reason is specified
  * constant: Handle cfg in associated constants.
  * tests: Add a test for bitflags + disjoint cfg.
  * Remove "display" feature from the toml crate
  * DOC: Add metatensor
  * Fix #1085 - Incorrect detection of duplicated constants
  * chore: More clippy fixes.
  * docs: Correct after_include type in example config
  * cargo update
  * cfg: Remove another clippy warning.
  * Fix `clippy::uninlined_format_args`
  * Update toml to 0.9
  * Release 0.29.0
  * Support no-export annotation for statics and functions.
  * conditional fields of constexpr literal structs
  * Add LiteralStructField
  * Github action: Add aarch64 to deploy
  * Add rename rule for generated associated constant
  * Upgrade heck to 0.5
  * Add support for an optional nullable attribute
  * docs.md: Fix deprecated_with_note and deprecated_variant_with_note being spelled as 'notes'
  * Fix generic with "void" default
  * The return of Cast is simplified
  * Added tests for as keyword inside array into structs
  * Fixed error generation of structures using the keyword of as inside arrays
  * Added test for unsafe(no_mangle) attribute
  * Added tests for unsafe methotd's atributs
  * Fixed handling of trait methods containing the unsafe attribute
  * Rename -Zparse-only
  * Release 0.28.0
  * tests: Fix symbol file and tests.
  * Appease clippy.
  * tests: Run rustfmt.</changelog>
  <changelog author="william.brown@suse.com" date="1775044800">- Update to version 0.29.2+git0:
  * ci: Add a meta job to block the merge queue on it.
  * Check for CMSE ABI's as well
  * Fix doc attribute parsing to properly handle block comments
  * Expose the line_endings config option to use with the builder
  * fix env in workflow file
  * use env to pass output parameters
  * Explicitly request serde's std features to avoid issues with newer toml versions.
  * Account for master -&gt; main rename.
  * Update changelog and bump version.
  * enum: Track dependencies properly in enumerations.</changelog>
  <changelog author="william.brown@suse.com" date="1781265600">- Update to version v0.29.4+git0:
  * Bump version.
  * tests: Add some tests for constant enums.
  * ir: Add support for arrays.
  * ir: Allow constant literals with enum variants.
  * ir: Use Path for ConstExprs.
  * Bump version to 0.29.3 and update CHANGES doc
  * tests: Fix tests with modern gcc.
  * Use C++ fixed-type enumeration syntax under C23 (or higher) as well
  * Allow `pub` access to `ReprType` fields</changelog>
</package>
</otherdata>