- Firefox Extended Support Release 128.0esr ESR
  * New: ### General
    * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
    * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
    * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
    * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
    * It is now possible to copy and paste any file from the
    operating system into Firefox.
    * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
    * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
    * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
    * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
    * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
    * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved. (bmo#None)
  * New: ### PDF Viewer
    * The Firefox PDF viewer has expanded PDF editing
    capabilities:
        * Text highlighting is now supported.
        * Editing already-existing text annotations is now
    supported.
        * Images and alt text can be added in addition to text
    and drawings.
    * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
    * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * New: ### Firefox View
    * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
    * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
    * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
    * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
    * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * New: ### Security & Privacy
    * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
    * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
    * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &
    Security → Certificates).
    * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
    * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
    * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
    * Firefox now supports a setting (in Preferences → Privacy &
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
    * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * New: ### Anti-Fingerprinting
    * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
    * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
    * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
    * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
    * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * New: ### Windows
    * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
    * The background updater now updates properly when there are
    multiple user accounts on a system.
    * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * New: ### macOS
    * Firefox now supports Voice Control commands on macOS
    systems.
    * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
    * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * New: ### Linux
    * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad & touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
    * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * New: ### Video Playback
    * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
    * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
    * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
    * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel. (bmo#None)
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
    * Firefox will now automatically try to upgrade <img>,
    <audio>, and <video> elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
    * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
      [2]: http://facebook.github.io/zstd/ (bmo#None)
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
    * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
    * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
    * The TranslateEnabled policy has been added.
    * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
    * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
    * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
    * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
    * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
    * The UserMessaging policy has been updated to remove the
    WhatsNew option.
    * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
- Mozilla Firefox ESR 128.0
  https://www.mozilla.org/security/advisories/mfsa2024-29
  MFSA 2024-29 (boo#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- Update mozilla-bmo1504834-part1.patch,
  mozilla-rust-disable-future-incompat.patch,
  mozilla-silence-no-return-type.patch
- Update create_tar.sh from our firefox-scripts git
- Use cargo/rust1.78 for building.

• Files Changed
• Browse Source

- Mozilla Firefox ESR 128.0
  https://www.mozilla.org/security/advisories/mfsa2024-??
  MFSA 2024-?? (boo#???????)
- Update mozilla-bmo1504834-part1.patch,
  mozilla-rust-disable-future-incompat.patch,
  mozilla-silence-no-return-type.patch
- Update create_tar.sh from our firefox-scripts git

• Files Changed
• Browse Source

Based on https://hg.mozilla.org/releases/mozilla-esr128/rev/FIREFOX_128_0esr_BUILD2

- Mozilla Firefox ESR 128.0
https://www.mozilla.org/security/advisories/mfsa2024-??
MFSA 2024-?? (boo#???????)
- Update mozilla-bmo1504834-part1.patch,
mozilla-rust-disable-future-incompat.patch,
mozilla-silence-no-return-type.patch
- Update create_tar.sh from our firefox-scripts git

• Browse Source