CVS commit: pkgsrc/www/firefox

["Ryo ONODERA" <ryoon%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Thu Oct  8 20:57:15 UTC 2026

Modified Files:
        pkgsrc/www/firefox: Makefile distinfo
        pkgsrc/www/firefox/patches: patch-browser_app_profile_firefox.js
            patch-python_sites_build.txt
Added Files:
        pkgsrc/www/firefox/patches: patch-widget_gtk_nsAppShell.cpp

Log Message:
www/firefox: Update to 157.0.1

* Disable creating nodejs kit because of errors.

Changelog:
157.0.1:
Fixed

  * Fixed downloads failing on macOS when Firefox is set to ask where to save
    files but doesn't have permission to access the Downloads folder. (Bug
    2077390)

  * Fixed the sidebar getting stuck on the Bookmarks or AI Chatbot panel for
    some users. (Bug 2076296)

  * Fixed the Restore from Backup option not appearing during onboarding on
    Windows. (Bug 2073401)

  * Security fix.

Security fixes:
Mozilla Foundation Security Advisory 2026-104
#CVE-2026-106016: Mitigation bypass in the File Handling component

157.0:
New

  * Firefox's biggest visual refresh in years is now available, with a
    modernized look across the browser toolbars, sidebar, menus and individual
    features, built with our updated design system. It also includes:

      + New built-in themes with light and dark versions, to personalize the
        look of Firefox in one click.
      + A new compact mode that reduces toolbar and tab spacing to leave more
        room for web content, useful on smaller screens and in split-screen
        layouts.
  * WebRTC video calls can now use hardware AV1 decoding on devices that
    support it, instead of always decoding AV1 video in software.

  * Firefox now shows a warning in the site information panel (the shield icon
    in the address bar) and in Settings when it has been set up to record its
    encryption keys, which could let other software on the computer read
    encrypted web traffic.

  * Firefox Suggest now offers suggestions in the address bar in Austria,
    Belgium, Czech Republic, Denmark, Finland, Hungary, Ireland, Luxembourg,
    Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, and
    Switzerland. They can be controlled in the Firefox Suggest settings. Learn
    more.

Fixed

  * Fixed video from phones and tablets appearing sideways or upside down in
    WebRTC calls.

  * Fixed the address bar searching for the typed text instead of opening the
    selected suggestion when a page was still loading, such as shortly after
    Firefox started.

  * Fixed some HDR videos encoded in 8-bit color formats looking dull and gray
    on Windows instead of displaying in HDR.

  * Improved audio and video synchronization when repeatedly changing the
    playback speed of videos, for example on YouTube.

  * Fixed the Vertical Tabs sidebar not reappearing when the cursor moves to
    the edge of the screen in full screen mode.

  * Fixed an issue on Windows where making a video full screen would leave the
    Windows taskbar showing over the video.

  * Various security fixes.

Security fixes:
Mozilla Foundation Security Advisory 2026-97
#CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback
 component
#CVE-2026-100757: Use-after-free in the Widget component
#CVE-2026-100758: Sandbox escape in the DOM: Navigation component
#CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component
#CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component
#CVE-2026-100761: Privilege escalation due to use-after-free in the Graphics:
 WebGPU component
#CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content
 Processes component
#CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU
 component
#CVE-2026-100764: Privilege escalation due to incorrect boundary conditions in
 the Graphics: WebGPU component
#CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100766: Information disclosure in the Networking: JAR component
#CVE-2026-100767: Use-after-free in the Networking: Cache component
#CVE-2026-100768: Use-after-free in the Graphics: WebGPU component
#CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content
 Processes component
#CVE-2026-100771: Undefined behavior in the DOM: Streams component
#CVE-2026-100772: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100773: Use-after-free in the Storage: IndexedDB component
#CVE-2026-100774: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100775: Sandbox escape in the Graphics component
#CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML
 component
#CVE-2026-100779: Use-after-free in the XSLT component
#CVE-2026-100780: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the
 Graphics: WebRender component
#CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in
 the Graphics component
#CVE-2026-100783: Uninitialized memory in the Audio/Video component
#CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-100785: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics
 component
#CVE-2026-100787: Sandbox escape in the XUL component
#CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component
#CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-100790: Use-after-free in the XSLT component
#CVE-2026-100791: Use-after-free in the DOM: Core & HTML component
#CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-100793: JIT miscompilation in the JavaScript Engine component
#CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the
 Internationalization component
#CVE-2026-96869: Information disclosure in the Networking component
#CVE-2026-100795: Denial-of-service in the Networking component
#CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics:
 WebRender component
#CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component
#CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component
#CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access
 APIs component
#CVE-2026-100801: Privilege escalation in the DLL Services component
#CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component
#CVE-2026-100803: Same-origin policy bypass in the WebExtensions component
#CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences:
 Backend component
#CVE-2026-100805: Race condition, use-after-free in the Audio/Video component
#CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component
#CVE-2026-100807: Privilege escalation in the DOM: Service Workers component
#CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component
#CVE-2026-100809: Same-origin policy bypass in the DevTools component
#CVE-2026-100810: Other issue in the DevTools component
#CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML
 component
#CVE-2026-100812: Denial-of-service in the Graphics component
#CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component
#CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT
 component
#CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component
#CVE-2026-100816: Site isolation issue in the DOM: Networking component
#CVE-2026-100817: Other issue in the JavaScript: WebAssembly component
#CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk
 component
#CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the
 XPCOM component
#CVE-2026-100820: Privilege escalation in the Address Bar component
#CVE-2026-100821: Site isolation issue in the Panning and Zooming component
#CVE-2026-100822: Spoofing issue in the Networking: HTTP component
#CVE-2026-100823: Spoofing issue in the Downloads component in Firefox for
 Android
#CVE-2026-100824: Privilege escalation in the Places component
#CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-100826: Denial-of-service in the Storage: StorageManager component
#CVE-2026-100828: Mitigation bypass in the Bookmarks & History component
#CVE-2026-100829: Mitigation bypass in the DOM: Security component
#CVE-2026-100830: Mitigation bypass in the DOM: Navigation component
#CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling
 component


To generate a diff of this commit:
cvs rdiff -u -r1.676 -r1.677 pkgsrc/www/firefox/Makefile
cvs rdiff -u -r1.595 -r1.596 pkgsrc/www/firefox/distinfo
cvs rdiff -u -r1.26 -r1.27 \
    pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js
cvs rdiff -u -r1.3 -r1.4 \
    pkgsrc/www/firefox/patches/patch-python_sites_build.txt
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/www/firefox/patches/patch-widget_gtk_nsAppShell.cpp

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox/Makefile
diff -u pkgsrc/www/firefox/Makefile:1.676 pkgsrc/www/firefox/Makefile:1.677
--- pkgsrc/www/firefox/Makefile:1.676   Tue Sep 29 06:08:04 2026
+++ pkgsrc/www/firefox/Makefile Thu Oct  8 20:57:14 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.676 2026/09/29 06:08:04 wiz Exp $
+# $NetBSD: Makefile,v 1.677 2026/10/08 20:57:14 ryoon Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            156.0
+MOZ_BRANCH=            157.0
 MOZ_BRANCH_MINOR=      .1
 CANDIDATE_BUILD=       # for release, make this empty
 
@@ -16,7 +16,6 @@ DIST_SUBDIR=  ${PKGNAME_NOREV}
 .endif
 
 PKGNAME=       ${DISTNAME:S/.source/${RCVER:S/build/rc/}/:S/esr//}
-PKGREVISION=   2
 CATEGORIES=    www
 EXTRACT_SUFX=  .tar.xz
 
@@ -54,6 +53,9 @@ LICENSE=      mpl-1.1
 #
 # -----------------------------------------------------------------------
 
+### As if 157.0, `make maintainer-files` does not work.
+### ryoon will disable build without nodejs for a while.
+FIREFOX_MAINTAINER=yes
 WRKSRC=                ${WRKDIR}/firefox-${FIREFOX_VER:C/b.*//}
 
 MOZILLA_DIR=   # empty

Index: pkgsrc/www/firefox/distinfo
diff -u pkgsrc/www/firefox/distinfo:1.595 pkgsrc/www/firefox/distinfo:1.596
--- pkgsrc/www/firefox/distinfo:1.595   Sat Sep 26 11:10:38 2026
+++ pkgsrc/www/firefox/distinfo Thu Oct  8 20:57:14 2026
@@ -1,12 +1,12 @@
-$NetBSD: distinfo,v 1.595 2026/09/26 11:10:38 ryoon Exp $
+$NetBSD: distinfo,v 1.596 2026/10/08 20:57:14 ryoon Exp $
 
-BLAKE2s (firefox-156.0.1.source.tar.xz) = dfaef24cc7ad06c7f5e6609574a713e5717fe3a87ecc8feef0cb77530c389123
-SHA512 (firefox-156.0.1.source.tar.xz) = 80a32a79268b672206f5477ca6bfde620cb7419b27aac090e01f06df06990ee0bbd81bb5c4aa78ac1d0edb26b133b1c6fa11cb6522445eccd70c82e719a24d5b
-Size (firefox-156.0.1.source.tar.xz) = 806005992 bytes
+BLAKE2s (firefox-157.0.1.source.tar.xz) = 5bdeab611f6bffe5dd7ccacd349b6dcc32dcda646d713ccd73b69ae4f2970ec3
+SHA512 (firefox-157.0.1.source.tar.xz) = c019202b2f87d25b3605bbf7266f3bb4d59745e48536f297d3f00cc3524a1cd2eba416a5a3cd0ecee6b0762d0f35bf3c5fcce286ebc7bc741263bebd0f102858
+Size (firefox-157.0.1.source.tar.xz) = 811383348 bytes
 BLAKE2s (nodejs-output-156.0.1.tgz) = 26aa0e33c007e8c08ebbe87dd1004c0cee01d9bed8a3b96ed5ccdc4062324e8d
 SHA512 (nodejs-output-156.0.1.tgz) = 6b6bc87f4dacc2f77bb525aa484ac7cb5035502033dc37f8b46d047659a516631281e332515ca450cd5cce4d01d7102d7fc011771a9bc0ea15633b233a0ffe31
 Size (nodejs-output-156.0.1.tgz) = 251380 bytes
-SHA1 (patch-browser_app_profile_firefox.js) = f111e03a9c70b6ad5ba64bf95d45302b9256687a
+SHA1 (patch-browser_app_profile_firefox.js) = 1fe46a0bb3d29520d19755a8786457b3259a6c96
 SHA1 (patch-build_gn__processor.py) = c9b2f31787704c3fec466711010ef632199ae385
 SHA1 (patch-build_moz.configure_init.configure) = 65deb3c233df0aab81eb1fca05d708e5a4ed169a
 SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
@@ -42,7 +42,7 @@ SHA1 (patch-mozglue_misc_Now.cpp) = 7607
 SHA1 (patch-netwerk_protocol_http_nsHttpHandler.cpp) = 67493b4635041d21ff9fbfda80b3197fed542a26
 SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = c99c3ce679f4196fc3baaf65051471a13d6fe8cd
 SHA1 (patch-python_mozbuild_mozbuild_backend_recursivemake.py) = 5be4183d9075f5a3a3c6b3e0338473af185fb50e
-SHA1 (patch-python_sites_build.txt) = f03f059bbe79bfdf7f1db5475279edb3c9d6ebed
+SHA1 (patch-python_sites_build.txt) = 2f716b67b47d8d0f648f466aabdc1c4e90d0f024
 SHA1 (patch-python_sites_mach.txt) = be62d091430daaa2ceeff3aff07f71275896352f
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc) = b1067a6804470f7e365f347683b7d505853fd799
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_vdso__support.cc) = f9c44d0d6fd952296f23c24f56053958b30d8e5c
@@ -71,5 +71,6 @@ SHA1 (patch-third__party_wasm2c_src_preb
 SHA1 (patch-toolkit_components_terminator_nsTerminator.cpp) = e905e38ef1b88d764c695c019f15609350c1c43b
 SHA1 (patch-toolkit_moz.configure) = 1306e7ac3c3939886aff38a58dd3162e6517409b
 SHA1 (patch-toolkit_mozapps_installer_packager.mk) = c77481a1f8fe1e237b7fe87e3e586ca886ac1d3d
+SHA1 (patch-widget_gtk_nsAppShell.cpp) = 69034ac3b176b56c93cbc7e075c484d56d61ca6a
 SHA1 (patch-xpcom_base_nscore.h) = 1ac4d34d3c9e80bc1ac966c6c84cb320bc0fa1ec
 SHA1 (patch-xpcom_reflect_xptcall_md_unix_moz.build) = 8980398051fa16c7283acb6d323419993cce1420

Index: pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js
diff -u pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.26 pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.27
--- pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.26        Fri Aug 14 12:26:11 2026
+++ pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js     Thu Oct  8 20:57:15 2026
@@ -1,11 +1,11 @@
-$NetBSD: patch-browser_app_profile_firefox.js,v 1.26 2026/08/14 12:26:11 ryoon Exp $
+$NetBSD: patch-browser_app_profile_firefox.js,v 1.27 2026/10/08 20:57:15 ryoon Exp $
 
 This patch modifies default Firefox settings - see the comments above
 each one.
 
---- browser/app/profile/firefox.js.orig        2026-08-10 18:46:16.000000000 +0000
+--- browser/app/profile/firefox.js.orig        2026-09-24 10:45:34.000000000 +0000
 +++ browser/app/profile/firefox.js
-@@ -2929,6 +2929,36 @@ pref("toolkit.coverage.endpoint.base", "https://covera
+@@ -3055,6 +3055,36 @@ pref("toolkit.coverage.endpoint.base", "https://covera
  pref("toolkit.coverage.enabled", false);
  pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org";);
  
@@ -39,6 +39,6 @@ each one.
 +// The root cause of this should be investigated.
 +pref("dom.serviceWorkers.enabled", false);
 +
- // Discovery prefs
+ // Enable personalized extension recommendations
  pref("browser.discovery.enabled", true);
- pref("browser.discovery.containers.enabled", true);
+ 

Index: pkgsrc/www/firefox/patches/patch-python_sites_build.txt
diff -u pkgsrc/www/firefox/patches/patch-python_sites_build.txt:1.3 pkgsrc/www/firefox/patches/patch-python_sites_build.txt:1.4
--- pkgsrc/www/firefox/patches/patch-python_sites_build.txt:1.3 Tue Jul 21 15:25:01 2026
+++ pkgsrc/www/firefox/patches/patch-python_sites_build.txt     Thu Oct  8 20:57:15 2026
@@ -1,12 +1,12 @@
-$NetBSD: patch-python_sites_build.txt,v 1.3 2026/07/21 15:25:01 ryoon Exp $
+$NetBSD: patch-python_sites_build.txt,v 1.4 2026/10/08 20:57:15 ryoon Exp $
 
 * We are offline, so do not try to download from pypi.
   No need to wait a timeout.
 
---- python/sites/build.txt.orig        2026-07-13 13:09:21.000000000 +0000
+--- python/sites/build.txt.orig        2026-09-24 10:45:43.000000000 +0000
 +++ python/sites/build.txt
 @@ -1,6 +1,6 @@ pth:third_party/python/vsdownload
- requires-python:>=3.9
+ requires-python:>=3.10
  pth:third_party/python/vsdownload
 -pypi-optional:taskcluster-taskgraph==24.1.1:toolchain artifacts will not be bootstrapped
 +#pypi-optional:taskcluster-taskgraph==24.1.1:toolchain artifacts will not be bootstrapped

Added files:

Index: pkgsrc/www/firefox/patches/patch-widget_gtk_nsAppShell.cpp
diff -u /dev/null pkgsrc/www/firefox/patches/patch-widget_gtk_nsAppShell.cpp:1.1
--- /dev/null   Thu Oct  8 20:57:15 2026
+++ pkgsrc/www/firefox/patches/patch-widget_gtk_nsAppShell.cpp  Thu Oct  8 20:57:15 2026
@@ -0,0 +1,16 @@
+$NetBSD: patch-widget_gtk_nsAppShell.cpp,v 1.1 2026/10/08 20:57:15 ryoon Exp $
+
+* Fix build without dbus option.
+
+--- widget/gtk/nsAppShell.cpp.orig     2026-09-29 15:04:11.531003992 +0000
++++ widget/gtk/nsAppShell.cpp
+@@ -30,8 +30,8 @@
+ #ifdef MOZ_ENABLE_DBUS
+ #  include <gio/gio.h>
+ 
+-#  include "WidgetUtilsGtk.h"
+ #endif
++#include "WidgetUtilsGtk.h"
+ #include "HeadlessScreenHelper.h"
+ #include "ScreenHelperGTK.h"
+ #include "WakeLockListener.h"