CVS commit: pkgsrc/mail/thunderbird

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/mail/thunderbird
From: "Ryo ONODERA" <ryoon%netbsd.org@localhost>
Date: Sun, 4 Oct 2026 13:27:54 +0000

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Sun Oct  4 13:27:54 UTC 2026

Modified Files:
        pkgsrc/mail/thunderbird: Makefile PLIST distinfo
        pkgsrc/mail/thunderbird/patches: patch-browser_app_profile_firefox.js
            patch-python_sites_build.txt

Log Message:
mail/thunderbird: Update to 157.0.1

Changelog:
157.0.1:
What's Fixed
fixed
EWS/Graph messages could crash Thunderbird when handling relative URL fragments

157.0:
What's New
new
Enterprise policy DisableChat disables Thunderbird Chat functionality

new
Enterprise policy DisableFileLink disables Thunderbird FileLink functionality

What's Changed
changed
Preference mailnews.headers.minNumHeaders has been removed

changed
Allow viewing remote content in OpenPGP messages encrypted with integrity
protection

changed
RNP command-line utilities are no longer included with Thunderbird

changed
IMAP/POP manual config port field is now optional

changed
Thundermail built-in add-on updated to v2.0.16

What;s Fixed
fixed
Ctrl+Shift+K could fail to open the Quick Filter UI

fixed
Message list could show the wrong sender for messages

fixed
Status bar could remain active and cause 100% CPU usage after activity ended

fixed
OpenPGP discovery failed to find replacement keys after a key was revoked

fixed
Valid RSA OpenPGP keys could be rejected, preventing encryption

fixed
Sent messages could silently fail to save to the IMAP Sent folder

fixed
Sending message did not fail gracefully with malformed references header

fixed
Thunderbird could hang when waiting for IMAP server greeting during account
setup

fixed
Account Hub account creation could fail with malformed URI

fixed
Custom OAuth Endpoint Host incorrectly required a full URL instead of a domain

fixed
Message filters could falsely match when evaluating search term failures

fixed
CardDAV address books could fail to sync when no password prompt was needed

fixed
Yahoo emails appeared blank with MIME handlers disabled via
mailnews.display.disallow_mime_handlers

fixed
Pending moves within the same IMAP account could make messages disappear

fixed
Inline images could disappear after editing and resaving drafts

fixed
SMTP OAuth2 failed when large access token exceeded command line length limit

fixed
Gmail OAuth2 authentication could intermittently fail on Windows

fixed
Exchange NTLM authentication failed when updated passwords were not saved

fixed
SMTP AUTH LOGIN could fail after username challenges and close the connection

fixed
AppUpdatePin policy did not prevent Thunderbird from updating beyond pinned
version

fixed
Recurring events could appear after their configured end date

fixed
CalDAV task body could remain outdated after syncing changes from another
client

fixed
CalDAV invitations could fail when accepted before the calendar synced

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-101
#CVE-2026-103500: Heap buffer overflow opening large email
#CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback
 component
#CVE-2026-100757: Use-after-free in the Widget component
#CVE-2026-100758: Sandbox escape in the DOM: Navigation component
#CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component
#CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component
#CVE-2026-100761: Privilege escalation due to use-after-free in the Graphics:
 WebGPU component
#CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content
 Processes component
#CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU
 component
#CVE-2026-100764: Privilege escalation due to incorrect boundary conditions in
 the Graphics: WebGPU component
#CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100766: Information disclosure in the Networking: JAR component
#CVE-2026-100767: Use-after-free in the Networking: Cache component
#CVE-2026-100768: Use-after-free in the Graphics: WebGPU component
#CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content
 Processes component
#CVE-2026-100771: Undefined behavior in the DOM: Streams component
#CVE-2026-100772: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100773: Use-after-free in the Storage: IndexedDB component
#CVE-2026-100774: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100775: Sandbox escape in the Graphics component
#CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML
 component
#CVE-2026-100779: Use-after-free in the XSLT component
#CVE-2026-100780: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the
 Graphics: WebRender component
#CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in
 the Graphics component
#CVE-2026-100783: Uninitialized memory in the Audio/Video component
#CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-100785: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics
 component
#CVE-2026-100787: Sandbox escape in the XUL component
#CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component
#CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-100790: Use-after-free in the XSLT component
#CVE-2026-100791: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-100793: JIT miscompilation in the JavaScript Engine component
#CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the
 Internationalization component
#CVE-2026-96869: Information disclosure in the Networking component
#CVE-2026-100795: Denial-of-service in the Networking component
#CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics:
 WebRender component
#CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component
#CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component
#CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access
 APIs component
#CVE-2026-100801: Privilege escalation in the DLL Services component
#CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component
#CVE-2026-100803: Same-origin policy bypass in the WebExtensions component
#CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences:
 Backend component
#CVE-2026-100805: Race condition, use-after-free in the Audio/Video component
#CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component
#CVE-2026-100807: Privilege escalation in the DOM: Service Workers component
#CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component
#CVE-2026-100809: Same-origin policy bypass in the DevTools component
#CVE-2026-100810: Other issue in the DevTools component
#CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML
 component
#CVE-2026-100812: Denial-of-service in the Graphics component
#CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component
#CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT
 component
#CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component
#CVE-2026-100816: Site isolation issue in the DOM: Networking component
#CVE-2026-100817: Other issue in the JavaScript: WebAssembly component
#CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk
 component
#CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the
 XPCOM component
#CVE-2026-100820: Privilege escalation in the Address Bar component
#CVE-2026-100821: Site isolation issue in the Panning and Zooming component
#CVE-2026-100822: Spoofing issue in the Networking: HTTP component
#CVE-2026-100824: Privilege escalation in the Places component
#CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-100826: Denial-of-service in the Storage: StorageManager component
#CVE-2026-100828: Mitigation bypass in the Bookmarks & History component
#CVE-2026-100829: Mitigation bypass in the DOM: Security component
#CVE-2026-100830: Mitigation bypass in the DOM: Navigation component
#CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling
 component


To generate a diff of this commit:
cvs rdiff -u -r1.372 -r1.373 pkgsrc/mail/thunderbird/Makefile
cvs rdiff -u -r1.99 -r1.100 pkgsrc/mail/thunderbird/PLIST
cvs rdiff -u -r1.302 -r1.303 pkgsrc/mail/thunderbird/distinfo
cvs rdiff -u -r1.7 -r1.8 \
    pkgsrc/mail/thunderbird/patches/patch-browser_app_profile_firefox.js
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/mail/thunderbird/patches/patch-python_sites_build.txt

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/thunderbird/Makefile
diff -u pkgsrc/mail/thunderbird/Makefile:1.372 pkgsrc/mail/thunderbird/Makefile:1.373
--- pkgsrc/mail/thunderbird/Makefile:1.372      Tue Sep 29 06:06:25 2026
+++ pkgsrc/mail/thunderbird/Makefile    Sun Oct  4 13:27:53 2026
@@ -1,9 +1,8 @@
-# $NetBSD: Makefile,v 1.372 2026/09/29 06:06:25 wiz Exp $
+# $NetBSD: Makefile,v 1.373 2026/10/04 13:27:53 ryoon Exp $
 
 DISTNAME=      thunderbird-${TB_VER}.source
 PKGNAME=       thunderbird-${TB_VER:S/esr//}
-PKGREVISION=   2
-TB_VER=                156.0.1
+TB_VER=                157.0.1
 CATEGORIES=    mail
 MASTER_SITES=  ${MASTER_SITE_MOZILLA:=thunderbird/releases/${TB_VER}/source/}
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/mail/thunderbird/PLIST
diff -u pkgsrc/mail/thunderbird/PLIST:1.99 pkgsrc/mail/thunderbird/PLIST:1.100
--- pkgsrc/mail/thunderbird/PLIST:1.99  Wed Sep 23 08:48:57 2026
+++ pkgsrc/mail/thunderbird/PLIST       Sun Oct  4 13:27:53 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.99 2026/09/23 08:48:57 ryoon Exp $
+@comment $NetBSD: PLIST,v 1.100 2026/10/04 13:27:53 ryoon Exp $
 bin/thunderbird
 lib/thunderbird/application.ini
 lib/thunderbird/chrome/icons/default/TB-symbolic.svg
@@ -39,10 +39,7 @@ lib/thunderbird/omni.ja
 lib/thunderbird/pingsender
 lib/thunderbird/platform.ini
 lib/thunderbird/removed-files
-lib/thunderbird/rnp-cli
-lib/thunderbird/rnpkeys
 lib/thunderbird/thunderbird
 lib/thunderbird/thunderbird-bin
 share/applications/thunderbird.desktop
 share/pixmaps/thunderbird.png
-@pkgdir lib/thunderbird/extensions

Index: pkgsrc/mail/thunderbird/distinfo
diff -u pkgsrc/mail/thunderbird/distinfo:1.302 pkgsrc/mail/thunderbird/distinfo:1.303
--- pkgsrc/mail/thunderbird/distinfo:1.302      Sat Sep 26 07:45:51 2026
+++ pkgsrc/mail/thunderbird/distinfo    Sun Oct  4 13:27:53 2026
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.302 2026/09/26 07:45:51 ryoon Exp $
+$NetBSD: distinfo,v 1.303 2026/10/04 13:27:53 ryoon Exp $
 
-BLAKE2s (thunderbird-156.0.1.source.tar.xz) = 1e7df5988e15eeb38102d5669d59811a20f4ff06b8161e543cbcb72f7a7b7a7d
-SHA512 (thunderbird-156.0.1.source.tar.xz) = e9262a4666e0107c7bc45fc2ad4bac4d6e5db4bfd3325d1d1c418f00adee777db969f8c12d8f310f45fdfda61b26e31bd0eea8b7d64ed1ee0050b5ee9235cfb0
-Size (thunderbird-156.0.1.source.tar.xz) = 943111452 bytes
-SHA1 (patch-browser_app_profile_firefox.js) = 1eaa674c0aa8279e2f9dc2eda582650a08156d65
+BLAKE2s (thunderbird-157.0.1.source.tar.xz) = 9ed62aeaa4b32242517db5b1f7e9747f25a7e15f3dc773aa946b8e444380a8b9
+SHA512 (thunderbird-157.0.1.source.tar.xz) = 12c6151150cadce68b113720788ff6d4cdcd39ae57131152f92a272a76c2590fd929edd45faed4e81e1f32eb58d0b22ca003a37294b9daf6648d39194f09fd95
+Size (thunderbird-157.0.1.source.tar.xz) = 948443048 bytes
+SHA1 (patch-browser_app_profile_firefox.js) = 1fe46a0bb3d29520d19755a8786457b3259a6c96
 SHA1 (patch-build_gn__processor.py) = c9b2f31787704c3fec466711010ef632199ae385
 SHA1 (patch-build_moz.configure_init.configure) = 65deb3c233df0aab81eb1fca05d708e5a4ed169a
 SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
@@ -44,7 +44,7 @@ SHA1 (patch-mozglue_misc_Now.cpp) = 7607
 SHA1 (patch-netwerk_protocol_http_nsHttpHandler.cpp) = 67493b4635041d21ff9fbfda80b3197fed542a26
 SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = c99c3ce679f4196fc3baaf65051471a13d6fe8cd
 SHA1 (patch-python_mozbuild_mozbuild_backend_recursivemake.py) = 5be4183d9075f5a3a3c6b3e0338473af185fb50e
-SHA1 (patch-python_sites_build.txt) = f03f059bbe79bfdf7f1db5475279edb3c9d6ebed
+SHA1 (patch-python_sites_build.txt) = 2f716b67b47d8d0f648f466aabdc1c4e90d0f024
 SHA1 (patch-python_sites_mach.txt) = be62d091430daaa2ceeff3aff07f71275896352f
 SHA1 (patch-security_nss_lib_freebl_mpi_mpi.c) = 6cac13bc120d52b2c3628938d2fc1cba628b3a31
 SHA1 (patch-security_nss_lib_mozpkix_include_pkix_Input.h) = f9ee42e611d69e22f52fb3dede1304ad338ccc71

Index: pkgsrc/mail/thunderbird/patches/patch-browser_app_profile_firefox.js
diff -u pkgsrc/mail/thunderbird/patches/patch-browser_app_profile_firefox.js:1.7 pkgsrc/mail/thunderbird/patches/patch-browser_app_profile_firefox.js:1.8
--- pkgsrc/mail/thunderbird/patches/patch-browser_app_profile_firefox.js:1.7    Wed Dec 24 16:47:38 2025
+++ pkgsrc/mail/thunderbird/patches/patch-browser_app_profile_firefox.js        Sun Oct  4 13:27:53 2026
@@ -1,11 +1,11 @@
-$NetBSD: patch-browser_app_profile_firefox.js,v 1.7 2025/12/24 16:47:38 ryoon Exp $
+$NetBSD: patch-browser_app_profile_firefox.js,v 1.8 2026/10/04 13:27:53 ryoon Exp $
 
 This patch modifies default Firefox settings - see the comments above
 each one.
 
---- browser/app/profile/firefox.js.orig        2025-10-03 13:17:55.000000000 +0000
+--- browser/app/profile/firefox.js.orig        2026-09-24 10:45:34.000000000 +0000
 +++ browser/app/profile/firefox.js
-@@ -2842,6 +2842,39 @@ pref("app.normandy.onsync_skew_sec", 600
+@@ -3055,6 +3055,36 @@ pref("toolkit.coverage.endpoint.base", "https://covera
  pref("toolkit.coverage.enabled", false);
  pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org";);
  
@@ -30,9 +30,6 @@ each one.
 +pref("midi.prompt.testing", true);
 +pref("media.navigator.permission.disabled", true);
 +
-+// Avoid runtime error from WebGL for NetBSD systems
-+pref("webgl.out-of-process", false);
-+
 +// Avoid unfunctional video and audio codecs
 +pref("media.allow-audio-non-utility", true);
 +
@@ -42,6 +39,6 @@ each one.
 +// The root cause of this should be investigated.
 +pref("dom.serviceWorkers.enabled", false);
 +
- // Discovery prefs
+ // Enable personalized extension recommendations
  pref("browser.discovery.enabled", true);
- pref("browser.discovery.containers.enabled", true);
+ 

Index: pkgsrc/mail/thunderbird/patches/patch-python_sites_build.txt
diff -u pkgsrc/mail/thunderbird/patches/patch-python_sites_build.txt:1.2 pkgsrc/mail/thunderbird/patches/patch-python_sites_build.txt:1.3
--- pkgsrc/mail/thunderbird/patches/patch-python_sites_build.txt:1.2    Thu Jul 23 13:52:23 2026
+++ pkgsrc/mail/thunderbird/patches/patch-python_sites_build.txt        Sun Oct  4 13:27:54 2026
@@ -1,12 +1,12 @@
-$NetBSD: patch-python_sites_build.txt,v 1.2 2026/07/23 13:52:23 ryoon Exp $
+$NetBSD: patch-python_sites_build.txt,v 1.3 2026/10/04 13:27:54 ryoon Exp $
 
 * We are offline, so do not try to download from pypi.
   No need to wait a timeout.
 
---- python/sites/build.txt.orig        2026-07-13 13:09:21.000000000 +0000
+--- python/sites/build.txt.orig        2026-09-24 10:45:43.000000000 +0000
 +++ python/sites/build.txt
 @@ -1,6 +1,6 @@ pth:third_party/python/vsdownload
- requires-python:>=3.9
+ requires-python:>=3.10
  pth:third_party/python/vsdownload
 -pypi-optional:taskcluster-taskgraph==24.1.1:toolchain artifacts will not be bootstrapped
 +#pypi-optional:taskcluster-taskgraph==24.1.1:toolchain artifacts will not be bootstrapped

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index