newmoon (31.0.0-1) obs; urgency=medium * Major milestone release: - Once again accepts the installation of legacy Firefox extensions alongside own Pale Moon exclusive extensions. As always, please note that using extensions for an old version of a different browser is entirely at your own risk and we obviously cannot and will not provide much (if any) support for their use. Firefox extensions will be indicated with an orange dot in the Add-ons Manager in the browser. This will include the converted extensions for the few of you who are coming from recalled versions with -fxguid suffixes. - Implemented Global Privacy Control, taking the place of the unenforceable "DNT" (Do Not Track) signal. Through GPC, you indicate to websites that you do not want them to share or sell your data. - Implemented "optional chaining" (thanks, FranklinDM!). - Implemented setBaseAndExtent for text selections. - Implemented queueMicroTask() "pseudo-promise" callbacks. - Implemented accepting unit-less values for rootMargin in Intersection observers for web compatibility, making it act more like CSS margin as one would expect. - Improvements to CSS grid and flexbox rendering and display following spec changes and improving web compatibility. - Improved performance of parallel web workers in JavaScript. - Improved display of cursive scripts (on Windows). Good-bye Comic Sans! - Updated various in-tree libraries. - "Default browser" controls in preferences has been moved to "General". - Added support for extended VPx codec strings in media delivery via MSE (RFC-6381). - Fixed a long-time regression where the browser would no longer honor old-style body and iframe body margins when indicated in the HTML tags directly instead of CSS. This improves compatibility with particularly old and/or archived websites. - Fixed several crashes and stability issues. - Added a licensing screen to the Windows installer to clarify the browser's licensing. In other installations, you may find this licensing statement in the added license.txt file in the browser installation location. - Removed all Google SafeBrowsing/URLClassifier service code. - Restored Mac OS X code and buildability in the platform. - Removed the non-standard ArchiveReader DOM API that was only ever a prototype implementation from the platform. This potentially improves performance on some systems. - Removed leftover Electrolysis controls that could sometimes trick parts of the browser into starting in a (very broken) multi-process mode due to some plumbing for it still being present, if users would try to force the issue with preferences. Obviously, this was a footgun for power users. - Removed more Android/Fennec code (on-going effort to clean up our code). - Removed the Marionette automated testing framework. - Security issues addressed: CVE-2022-29915, CVE-2022-29911, and several issues that do not have a CVE number. - UXP Mozilla security patch summary: 4 fixed, 1 DiD, 19 not applicable. * Disable all patches. -- B. Stack Sun, 22 May 2022 11:04:46 -0400 newmoon (29.4.4-1+devuan) obs; urgency=medium - This is a security update. * Improved application library loading security. DiD * Fixed an issue in JavaScript serialization. DiD * Fixed a potential out-of-bounds issue in IndexedDB. DiD * Fixed a potential issue in widget data handling code. DiD * Fixed potentially exploitable crashes in handling truncated/corrupt media files or streams. * Fixed an issue in the DOM FileReader code. * Updated NSS to 3.52.3 to address a security issue. * Fixed the following security issues: CVE-2022-22736, CVE-2022-22741, CVE-2021-4140, CVE-2022-22746, CVE-2022-22744 and CVE-2022-22747. * Unified XUL Platform Mozilla Security Patch Summary: 8 fixed, 4 DiD, 17 not applicable. -- B. Stack Thu, 20 Jan 2022 14:02:40 -0500 newmoon (29.4.3-1+devuan) obs; urgency=medium - This is a security update with a few extras. * Restored the FUEL abstraction library again. * Added some extra sanity checks to timers and text fragments. DiD * Added a potential crash safeguard in program threading logic. DiD * Fixed the following security issues: CVE-2021-43537, CVE-2021-43541, CVE-2021-43536, CVE-2021-43545 and CVE-2021-43542. * Unified XUL Platform Mozilla Security Patch Summary: 5 fixed, 3 DiD, 10 not applicable. -- B. Stack Tue, 04 Jan 2022 12:54:49 -0500 newmoon (29.4.2-1+devuan) obs; urgency=medium - This is a security update. * Fixed a spec compliance issue with IDN that could potentially cause confusion of domain names. * Fixed several intermittent thread sanity issues. DiD * Fixed a potential UAF risk in certain situations in networking. DiD * Fixed a potential crash risk (not exposed). DiD * Fixed a potential spoofing risk using form validation. (CVE-2021-38508) * Fixed a script sandbox escape issue through XSLT. (CVE-2021-38503) * Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 1 already applied, 4 DiD, 7 not applicable. - Force using gcc-10 -- B. Stack Tue, 11 Nov 2021 09:09:16 -0500 newmoon (29.4.1-1+devuan) obs; urgency=medium - This is a security update. * Fixed potential crashes. DiD * Fixed a potential indirect exploit of Microsoft Internet Explorer. (CVE-2021-38492) * Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 DiD, 8 not applicable. -- B. Stack Tue, 14 Sep 2021 21:02:17 -0400 newmoon (29.4.0-2+devuan) obs; urgency=medium - Rebuild, with dh $@ --without autoreconf so it can actually build. -- B. Stack Sat, 11 Sep 2021 22:33:42 -0400 newmoon (29.4.0-1+devuan) obs; urgency=medium - This is a development, bugfix and security release * Implemented promise.allSettled(). * Implemented global origin on windows and workers. * Improved performance of memory allocations. * Updated libcubeb to the current development version. * This improves OSS compatibility and addresses potential crashes, performance issues and security issues. * Updated SQLite to 3.36.0. * Improved thread safety of the web content cache. DiD * Added several fixes to avoid potential crashes and security issues. DiD * Unified XUL Platform Mozilla Security Patch Summary: 5 DiD, 12 not applicable. -- B. Stack Tue, 17 Aug 2021 18:43:23 -0400 newmoon (29.3.0-1+devuan) obs; urgency=medium - This is a development, bugfix and security release. * "Web Developer" is now called "Developer Tools" in the menus. * Updated and aligned about:home, the QuickDial page and logopage styling. * Re-organized the privacy category in the preferences window. * Enabled brotli compression for http for sites that support it. See implementation notes. * Implemented EventTarget as a constructor. * Updated Windows 10 toolkit styling. * Updated the port blacklist (removed 10080). See implementation notes. * CSS: Implemented calc() and animation support for stroke-dashoffset. * Added support for checking boolean preferences to chrome CSS style sheets, to support more advanced theming options. * Added support for dynamic dark color capable themes in CSS. * Updated ResizeObserver implementation to a more recent specification. See implementation notes. * Removed a metric ton of Macintosh code. * Removed obsolete system theme support from the layout engine. * Fixed several crashes. * Linux: blocked particularly old versions of Mesa/Nouveau drivers due to issues. * Security issues addressed: CVE-2021-30547 and several other issues that don't have a CVE number. * Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 3 DiD, 2 deferred (DiD), 12 not applicable. -- B. Stack Mon, 19 Jul 2021 19:11:44 -0400 newmoon (29.2.1-1+devuan) obs; urgency=medium - This is a small bugfix release. * Worked around an issue with autocomplete popups sometimes failing to work (and added some debug console logging to it in case it happens to help find the root cause) * Fixed an issue with DOM mouse scrolling throwing errors. * Fixed a race with network detection routines firing incorrectly when resuming from standby. * Fixed a crash when using large uploads through DOM. * Fixed an issue where the menulist-button on editable menulist widgets was not visible on GTK3. * Reduced the number of reported "important preferences" in troubleshooting information, excluding individual printer details. * Fixed an issue with the JS JIT compiler not tracing debugger environments (DiD). -- B. Stack Wed, 09 Jun 2021 08:51:28 -0400 newmoon (29.2.0-1+devuan) obs; urgency=medium * This is a development and bugfix release. - Starting with this version, we will no longer be supporting unmaintained legacy Firefox extensions that are not updated for/targeting Pale Moon directly. - Please see https://forum.palemoon.org/viewtopic.php?f=1&t=26657 for details. * Changes/fixes: - When opening tabs from the History side bar, Pale Moon will now warn you about the action if it would result in opening many tabs at once. - Pale Moon now offers "Open All in Tabs" on bookmark folders even if there is only one sub-item in it, for UI consistency. - Added media format controls in the Content category of Preferences. - Added controls for preferred color scheme. See implementation notes. - Updated several site-specific user-agent overrides for web compatibility. - Removed the ability to accept Firefox IDs for extension installation. - Removed conditional Macintosh code from the application front-end. - Updated the AV1 reference library to 2.0. - Cleaned up more Android code from the platform. - Updated the embedded emoji font to cater to even more race-dependent profession emoji. - Fixed an overflow in clip paths, potentially causing them to be rendered incorrectly. - Added CSS values smooth, high-quality and pixelated to the image-rendering keyword. - Implemented Intl.NumberFormat.formatToParts() to allow deconstruction of localized number formats by scripts. - Reinstated the dom.details_element.enabled preference and fixed a rendering issue with summary/details html elements. - Fixed an issue with CSP .nonce attributes on elements. - Security issues addressed: CVE-2021-29946 DiD and CVE-2021-23994 DiD. - Unified XUL Platform Mozilla Security Patch Summary: 2 DiD, 14 not applicable. * Implementation notes: - This version adds support for the prefers-color-scheme CSS keyword. This keyword is a media query keyword that indicates to websites whether your content styling preference is "light" or "dark". Unlike other browsers where this will be tied to your system color scheme and determined automatically (which might be a point on which you can be fingerprinted, so this would be a privacy concern), we've decided to give the user control through Preferences -> Content -> Colors where you will find a new control to indicate your user preference (it defaults to "light" for everyone). While this control also gives you the option to disable this feature and effectively not support the keyword, be aware that this might cause issues on some websites that do not provide styling for "unspecified" color scheme preferences. - In the future we may add an "automatic" option similar to other browsers in case you regularly switch your system application style from light to dark and v.v. -- B. Stack Tue, 27 Apr 2021 14:56:07 -0400 newmoon (29.1.1-1+devuan) obs; urgency=medium * Changes/fixes: - Updated NSS to fix certificate import and keygen regressions. - Removed restrictions for units of width/height attributes on SVG elements. - Enabled scrollbar-width CSS keyword by default. - Security issues addressed: CVE-2021-23981 and a DiD fix for potential document parser confusion. - Unified XUL Platform Mozilla Security Patch Summary: 2 DiD, 9 not applicable. -- B. Stack Thu, 01 Apr 2021 12:53:29 -0400 newmoon (29.1.0-1+devuan) obs; urgency=medium * New features: - Language packs for the following newly-supported languages: Arabic (ar), Chinese Traditional (zh-TW), Croatian (hr), Danish (da), Finnish (fi), Galician (gl), Indonesian (id), Icelandic (is), Japanese (ja), Romanian (ro), Serbian (cyrillic) (sr), Slovenian (sl), Thai (th) - Implemented String.prototype.replaceAll(). - Implemented JSON superset proposal. - Implemented well-formed JSON stringify. - Implemented numeric separators in JavaScript. * Changes/fixes: - Updated timezone data to 2021a. - Updated the wording and inclusion of more select license blocks in about:license. - Updated some site-specific user-agent overrides for web compatibility. - Updated the lz4 library for performance and security updates. - Improved performance of JSON stringify. - Further improved support for building on FreeBSD. - Fixed a regression where changes to useragent compatibility required a restart to take effect. - Fixed a regression where AES-GCM in WebCrypto ("subtle" crypto API) wasn't working. - This could make certain login procedures fail to work. - Fixed a full browser deadlock when page scripting would flood browsing history with rapid location state changes. - Disabled AV1 codec use by default again since our implementation has significant streaming issues (particularly audio) that needs further work. - Added required interaction with file/folder open dialog boxes on html file input elements on some operating systems to avoid malicious content tricking users into uploading sensitive files unintentionally (related to CVE-2021-23956). - Added a font sanity check to avoid triggering a potential vulnerability on unpatched Windows operating systems (related to CVE-2021-24093). - Security issues addressed: CVE-2021-23974, CVE-2021-23973 and several memory safety hazards that don't have CVE numbers. - Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 DiD, 19 not applicable. -- B. Stack Tue, 02 Mar 2021 21:53:23 -0500 newmoon (29.0.1-1+devuan) obs; urgency=medium * Changes/fixes: - Fixed a browser crash when manipulating frame trees. - Fixed an issue with depth textures in ANGLE. - Updated the SSOAU for YouTube Studio. - Security issue addressed: ZDI-CAN-12197. -- B. Stack Mon, 15 Feb 2021 11:20:33 -0500 newmoon (29.0.0-1+devuan) obs; urgency=medium * New major milestone release: - Implemented Intl.PluralRules API for JavaScript. - Added a frequently-requested preference (browser.tabs.allowTabDetach) to disable "tearing off" of tabs (meaning dragging them outside of the tab bar resulting in them being made into their own window). - Added FLAC as a recognized filetype-by-extension. - Implemented basic support for the scrollbar-width CSS keyword. See implementation notes. - Added preliminary support for modern FreeBSD builds. - Selectively enabled core features of the DOM Animations API. - Enabled AV1 video support by default (previously built but not enabled in releases). - Added support for pointer events. - Added support for the SVG transform-box property. - Added support for the inputmode property for forms to enable context-sensitive display of soft keyboards. - Enabled shutting down of the file I/O worker when idle for a while (resource optimization). - Enabled blocking of auto-play of media in the background by default. - We now offer official GTK3 builds for Linux alongside the GTK2 builds. - Partial (and as of yet, not acceptably functional) implementation of Google WebComponents. See implementation notes. Changes/fixes: - Updated NSPR to 4.29. - Updated NSS to 3.59. - Disabled legacy database format for storage of certificates and passwords. - Updated several site-specific user-agent overrides for web compatibility. - Improved styling of the "find in page" bar to avoid unreadable text on some system themes. - Removed a large chunk of Android-specific code. - Split gkmedias.dll back out from xul.dll. - Cleaned up a number of redundant and obsolete code paths. - Fixed a regression with the Performance API. - Fixed an initialization issue in the browser when users would force-disable certain types of caching. - Fixed a crash when attempting to save a file from FTP that could be displayed in the browser. - Fixed the root cause of an issue with JavaScript module loading causing crashes. See implementation notes. - Fixed a rare initialization issue for the print preview window causing it to not display. - Fixed a crash on Mac when text input was not secure. - Disabled the Storage Manager API by default. - Disabled the html tag by default. If you still need this, you can re-enable it with the preference dom.menuitem.enabled in about:config. - Fixed a memory safety issue related to XUL trees (CVE-2021-23962). - Implemented several defense-in-depth measures to improve stability and future security. -- B. Stack Tue, 02 Feb 2021 19:04:30 -0500 newmoon (28.17.0-1+devuan) obs; urgency=low * This is a development, bugfix and security update. - Changed the way dates and times are formatted in the UI to properly adhere to the user's regional settings in the O.S. - Re-enabled the DOM Filesystem API for web compatibility. - Moved the global user-agent override to the networking component. See implementation notes. - Worked around crashes and run-time issues with module scripts. See implementation notes. - Fixed a website layout issue with table-styled elements potentially overlapping when placed inside a flexbox. - Fixed some code logic issues with websockets. - Fixed a regression when waking the computer from standby causing high CPU usage in some uncommon situations. - Updated the list of prohibited ports the browser can use. See implementation notes. - Updated root certificates. - Windows: Changed the way downloaded files without an extension are handled. See implementation notes. - Mac-beta: Improved version detection of MacOS including Big Sur. - Security issues addressed: CVE-2020-26978 and CVE-2020-35112. - Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 1 deferred to the next release, 16 not applicable. - The global user-agent override was moved to the networking component where it is actually implemented. The new preference name is network.http.useragent.global_override. Please note that using a blanket override is normally (very) counterproductive and does not, in fact, help much with privacy. It would also override the compatibility modes (Native/Gecko/Firefox) in Pale Moon. As such, the browser will now warn you if the user-agent is globally overridden (in preferences) and allow you to easily reset that override and re-enable the various compatibility modes. - Module scripting caused some persistent and very hard to track browser crashes that we've narrowed down to a specific optimization in the JavaScript JIT (Just-In-Time) compiler (IonMonkey). This optimization is now disabled by default but if you need that little extra performance (usually only noticed in very optimized code or some benchmarks) then you can re-enable it, trading in stability, by setting the new preference javascript.options.ion.inlining to true. - Prohibited ports: Pale Moon maintains a blacklist of ports the browser may normally not connect to on servers, to mitigate abusive web scripting employing your browser as an attack bot on servers (e.g. by connecting to mail servers or what not), NAT slipstreaming, and similar security issues. To more thoroughly prevent known abusable ports on servers, this list was extended with a number of additional default ports for various non-http protocols. - Downloaded files without a file extension: When a file without an extension is downloaded, we will now open the download folder where you may choose to take any specific action manually, instead of trying to execute it as a program or through an associated program. -- B. Stack Fri, 18 Dec 2020 13:52:12 -0500 newmoon (28.16.0-1+devuan) obs; urgency=low * This is a development and security update to the browser. * Note for Linux users: With CentOS 6 going end-of-life, this version will be the last for which we will be building 32-bit Linux official binaries to download. While your distribution may choose to continue offering 32-bit versions of the browser, built from source by the maintainers, we won't be offering any further official 32-bit Linux binaries on our website. Please check with your distribution's package maintainers to know if further 32-bit support will be available on your particular flavor of Linux. - Aligned CSS tab-size with the specification and un-prefixed it. - Updated Brotli library to 1.0.9. - Updated JAR lib code. - Optimized UI code, resulting in smaller downloads and less space consumed on disk. - Changed the default Firefox Compatibility version number to 68.0 (since versions ending in .9 makes some frameworks unhappy, refusing access to users) - Cleaned up HPKP leftovers. - Disabled the DOM filesystem API by default. - Removed Phone Vibrator API. - Fixed an issue where the software uninstaller would not remove the program files it should. - Fixed a devtools crash related to timeline snapshots. - Fixed an issue in Skia that could cause unsafe memory access. [DiD] - Fixed several data race conditions. [DiD] - Fixed an XSS vulnerability where scripts could be executed when pasting data into on-line editors. - Linux: Fixed an overflow issue in freetype. - Security issues addressed: CVE-2020-26960, CVE-2020-26951, CVE-2020-26956, CVE-2020-15999 and several others that do not have a CVE designation. - Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 4 defense-in-depth, 3 rejected, 20 not applicable. -- B. Stack Wed, 25 Nov 2020 09:13:05 -0500 newmoon (28.15.0-1+devuan) obs; urgency=low * This is a standard development and bugfix release. - Implemented support for CSS caret-color. - Implemented support for un-prefixed ::selection CSS pseudo-element styling. - Fixed another potential crashing scenario in ResizeObservers. - Fixed several crashes in the DOM Fetch API. - Fixed a crash in table pagination. - Security issues fixed: CVE-2020-15680 (VG-VD-20-115) and several memory safety hazards. - Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 defense-in-depth, 12 not applicable. * reenable jemalloc to match palemoon. * disable eme to match palemoon. * so now newmoon's only changes are config location and branding. -- B. Stack Tue, 27 Oct 2020 20:05:31 -0400 newmoon (28.14.2-3+devuan) obs; urgency=low * disable all use-system options to see if stability returns -- B. Stack Fri, 23 Oct 2020 14:58:17 -0400 newmoon (28.14.2-2+devuan) obs; urgency=low * revert to gtk2 to see if stability returns -- B. Stack Fri, 23 Oct 2020 22:40:55 -0400 newmoon (28.14.2-1+devuan) obs; urgency=low * Update version -- B. Stack Mon, 05 Oct 2020 09:07:33 -0400 newmoon (28.13.0-5+devuan) obs; urgency=medium * Import bluemoon icons from Gord N. Squash -- B. Stack Wed, 16 Sep 2020 19:16:08 -0400 newmoon (28.13.0-4+devuan) obs; urgency=low * Import xfce-helper/palemoon.desktop from stevep@mxlinux.org release -- B. Stack Wed, 09 Sep 2020 14:43:04 -0400 newmoon (28.13.0-3+devuan) obs; urgency=medium * This is a compatibility, bugfix and security update. Special thanks to our new code contributors this cycle (you know who you are)! - Updated the included site-specific user-agent overrides for a number of websites that need them. - Rewritten the browser's padlock code to use more modern APIs and provide more accurate security status indication. - Now also with localized tooltips! - Fixed a missing close button on the undo prompt after removing a thumbnail from the QuickDial new tab page. - Fixed an issue with the alternative stylesheet menu in the browser's UI not working. - Implemented the use of intrinsic aspect ratios for images to improve layout during load and page positioning. - Added a preference to the use of node.getRootNode and disabled by default. See implementation notes. - Added CSS -webkit-appearance as an alias for -moz-appearance to improve compatibility with websites that only try to use Chrome-specific keywords to style standard form elements. - Updated the SQLite library to 3.33.0. - Reinstated precise floating point precision model in JavaScript for those alternate builders who foolishly try to use the inaccurate "fast" model. - Improved spec compliance of modular JavaScript use (ECMAScript modules). - Changed media errors to be a more generic response, and added a preference (media.sourceErrorDetails.enabled) to enable detailed error reporting of media errors for debugging purposes. - Previously, detailed errors were provided by default which could lead to privacy issues. - Improved code stability of the AbortController implementation. - Fixed a race condition in the secure connection library (NSS). - Security issues fixed: CVE-2020-15664, CVE-2020-15666, CVE-2020-15667, CVE-2020-15668 and CVE-2020-15669. - Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 1 defense-in-depth, 1 rejected, 9 not applicable. * Implementation notes - In 28.11.0 we introduced node.getRootNode because some websites would fail with an error if this function was not present. Unfortunately, this caused problems with other sites that (incorrectly) assume Google WebComponents are available when this utility function is present (feature detection gone wrong). While it is considered by some to be part of the Google WebComponents implementation, it actually has utility value outside of that use. Because of the problems caused, we've added a preference and disabled it by default, fixing these kinds of websites. - When needed, you can re-enable this function with dom.getRootNode.enabled - This should improve web compatibility by default yet still allow users to enable this function for websites that use its utility but do not use WebComponents. -- B. Stack Fri, 04 Sep 2020 19:50:02 -0400 newmoon (28.12.0-2+devuan) obs; urgency=low * Forked from palemoon. This is an experimental release that does everything that the original dev team would consider wrong, including: - use gtk3 exclusively - enable webrtc - enable system libraries for everything possible -- B. Stack Thu, 27 Aug 2020 16:55:11 -0400 newmoon (28.12.0-1+devuan) UNRELEASED; urgency=low * First release of newmoon. -- B. Stack Wed, 05 Aug 2020 14:43:18 -0400