CVS commit: pkgsrc/www/firefox

["Ryo ONODERA" <ryoon%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Wed Jul 23 13:57:35 UTC 2025

Modified Files:
        pkgsrc/www/firefox: Makefile distinfo
        pkgsrc/www/firefox/files: node-wrapper.sh
        pkgsrc/www/firefox/patches: patch-js_src_jit_FlushICache.cpp
            patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc
            patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc
            patch-third__party_libwebrtc_rtc__base_memory__usage.cc
            patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc

Log Message:
www/firefox: Update to 140.0.4

Changelog:
140.0.4:
New

  * Firefox's QUIC stack is moving to a Rust based UDP I/O stack that leverages
    various modern, operating system specific calls, resulting in improved HTTP
    /3 upload and download performance.

Fixed

  * Fixed incorrect font selection in some cases when attempting to use color
    fonts. (Bug 1971053)

  * Fixed the search results not updating when switching source during a file
    search in the Developer Tool's debugger. (Bug 1971094)

140.0.2:
Fixed

  * Fixed a startup crash on Windows experienced by some users. (Bug 1974259)

140.0.1:
Fixed

  * Fixed text contrast issues in the sidebar with some dark themes. (Bug
    1971487)

  * Fixed a startup crash experienced by some users caused by DLL injection. (
    Bug 1973947)

140.0:
New

  * Vertical Tabs: You can now keep more ?? or fewer ?? pinned tabs in view for
    quicker access to important windows. Just drag the divider to resize your
    pinned tabs section.

  * Custom Search Engines: Firefox now supports adding even more search
    engines. To add a custom engine, right-click a search field of a supported
    website and select ??Add Search Engine??, or go to Settings > Search > Add
    (below the search shortcuts table) to manually enter a search URL.

  * Firefox Extensions: Customize your toolbar with the option to remove the
    extensions shortcut, giving you more control over your browser. When the
    button is hidden, you can access the extensions panel again at any time
    from the Firefox menu by clicking the Extensions menu item.

  * You can now unload tabs by right-clicking on a tab (or multiple selected
    tabs) and selecting "Unload Tab". This can speed up performance by reducing
    Firefox's memory and CPU usage.

  * Full-Page Translations now prioritizes translating only the content near
    your current view, improving speed and responsiveness. Content outside your
    view is skipped unless you scroll to it, reducing unnecessary resource
    usage.

  * Firefox builds in Arabic now come with a built-in Arabic dictionary for the
    Firefox spellchecker.

  * Address autofill enabled for users in Italy, Poland, and Austria.

Fixed

  * Various security fixes.

Mozilla Foundation Security Advisory 2025-51
#CVE-2025-6424: Use-after-free in FontFaceSet
#CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a
 persistent UUID
#CVE-2025-6426: No warning when opening executable terminal files on macOS
#CVE-2025-6427: connect-src Content Security Policy restriction could be
 bypassed
#CVE-2025-6428: Firefox for Android opened URLs specified in a link querystring
 parameter
#CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of
 youtube.com
#CVE-2025-6430: Content-Disposition header ignored when a file is included in
 an embed or object tag
#CVE-2025-6431: The prompt in Firefox for Android that asks before opening a
 link in an external application could be bypassed
#CVE-2025-6432: DNS Requests leaked outside of a configured SOCKS proxy
#CVE-2025-6433: WebAuthn would allow a user to sign a challenge on a webpage
 with an invalid TLS certificate
#CVE-2025-6434: HTTPS-Only exception screen lacked anti-clickjacking delay
#CVE-2025-6435: Save as in Devtools could download files without sanitizing the
 extension


To generate a diff of this commit:
cvs rdiff -u -r1.636 -r1.637 pkgsrc/www/firefox/Makefile
cvs rdiff -u -r1.558 -r1.559 pkgsrc/www/firefox/distinfo
cvs rdiff -u -r1.30 -r1.31 pkgsrc/www/firefox/files/node-wrapper.sh
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/www/firefox/patches/patch-js_src_jit_FlushICache.cpp
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_memory__usage.cc \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox/Makefile
diff -u pkgsrc/www/firefox/Makefile:1.636 pkgsrc/www/firefox/Makefile:1.637
--- pkgsrc/www/firefox/Makefile:1.636   Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/Makefile Wed Jul 23 13:57:34 2025
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.636 2025/07/15 13:58:05 ryoon Exp $
+# $NetBSD: Makefile,v 1.637 2025/07/23 13:57:34 ryoon Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            139.0
+MOZ_BRANCH=            140.0
 MOZ_BRANCH_MINOR=      .4
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
@@ -11,7 +11,7 @@ MASTER_SITES+=        ${MASTER_SITE_MOZILLA:=fi
 MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}
 EXTRACT_SUFX=  .tar.xz
 
-NODEJSKIT=             nodejs-output-139.0.tgz
+NODEJSKIT=             nodejs-output-140.0.4.tgz
 DISTFILES=             ${DEFAULT_DISTFILES} ${NODEJSKIT}
 SITES.${NODEJSKIT}=    ${MASTER_SITE_LOCAL}
 

Index: pkgsrc/www/firefox/distinfo
diff -u pkgsrc/www/firefox/distinfo:1.558 pkgsrc/www/firefox/distinfo:1.559
--- pkgsrc/www/firefox/distinfo:1.558   Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/distinfo Wed Jul 23 13:57:35 2025
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.558 2025/07/15 13:58:05 ryoon Exp $
+$NetBSD: distinfo,v 1.559 2025/07/23 13:57:35 ryoon Exp $
 
-BLAKE2s (firefox-139.0.4.source.tar.xz) = fd43e99072e9f199969b4d0527e58e472e8edcef785f52925f279d21784c29c6
-SHA512 (firefox-139.0.4.source.tar.xz) = fa5ae798b0cd485e0a56b0c57ed7f33e0d0ef921302dc0169eac91926194abe2070beb54239c81924f819a60b589f305f923970d753c07ba50acc36e1a492db4
-Size (firefox-139.0.4.source.tar.xz) = 644670560 bytes
-BLAKE2s (nodejs-output-139.0.tgz) = 8e09ba1884ac87b6755a31c5f62f1e5b2ba142689d8906e3f47ed29babcbcc50
-SHA512 (nodejs-output-139.0.tgz) = fe306729c6d706865df714e349c7a8747b57d0067a095753aee41a171394246a05efd4db716ab706ca61205983e62bfbd96c781c479ff762661df5b6c07da29c
-Size (nodejs-output-139.0.tgz) = 258868 bytes
+BLAKE2s (firefox-140.0.4.source.tar.xz) = c0d804be398c847c2cb93560846635d5e40631bdb455a341b0e9f301a8385005
+SHA512 (firefox-140.0.4.source.tar.xz) = 3de7c0871b8a45683f5c226fb3e91e597e8f89ef154b208b2a57c4d3ea9f39cb5c69ecbd5eca3b6da68d3775688d2289c1360c7d110c67bb1be1cf26ef8cf36d
+Size (firefox-140.0.4.source.tar.xz) = 642671864 bytes
+BLAKE2s (nodejs-output-140.0.4.tgz) = 7ebb5993c8c9d7d5492afdb9fa7fef74fec7753fb0b14673817f24faf4a7fca4
+SHA512 (nodejs-output-140.0.4.tgz) = e421b0b6be8b5b8dfda705eefcf4573a1270df9012dca5eac9ba0ac2af2bcc47dd66b1057106f8c2336a10bdcc39b9f852041dd33da9e7a8929d981dbb4e1fb4
+Size (nodejs-output-140.0.4.tgz) = 245385 bytes
 SHA1 (patch-browser_app_profile_firefox.js) = bc719edef37d18655ba79b030270438ee166fdaf
 SHA1 (patch-build_moz.configure_init.configure) = 65deb3c233df0aab81eb1fca05d708e5a4ed169a
 SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
@@ -20,7 +20,7 @@ SHA1 (patch-ipc_chromium_src_base_platfo
 SHA1 (patch-ipc_glue_GeckoChildProcessHost.cpp) = 63fbee04321f7ade20db4ccc1a1218b848344ce1
 SHA1 (patch-js-src-jit-arm64-vixl-MozCpu-vixl.cpp) = d90fca47d79551fd74214d47f8184670b901b792
 SHA1 (patch-js_public_Utility.h) = bb5464a0398b91693ab362e6b9b06d48429b9e7d
-SHA1 (patch-js_src_jit_FlushICache.cpp) = d1e611eaf7d7be22abfac6b39fbcd99df3570e47
+SHA1 (patch-js_src_jit_FlushICache.cpp) = f5d1fcb391c36a29fb71a78dbf731ee6a1cb17b6
 SHA1 (patch-js_src_util_NativeStack.cpp) = a0a16d8d8d78d3cc3f4d2a508586f1a7821f7dba
 SHA1 (patch-js_src_vm_TypedArrayObject-inl.h) = e7913c8d4b2b05b67040baa64dae62d6ba40390e
 SHA1 (patch-media_ffvpx_libavutil_arm_bswap.h) = 019677e249e744baea857ca17ef69d977f43b3a4

Index: pkgsrc/www/firefox/files/node-wrapper.sh
diff -u pkgsrc/www/firefox/files/node-wrapper.sh:1.30 pkgsrc/www/firefox/files/node-wrapper.sh:1.31
--- pkgsrc/www/firefox/files/node-wrapper.sh:1.30       Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/files/node-wrapper.sh    Wed Jul 23 13:57:35 2025
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-VERS=v24.1.0
+VERS=v24.4.0
 
 if [ "$1" = "-v" ] || [ "$1" = "--version" ]; then
        printf "${VERS}\n"

Index: pkgsrc/www/firefox/patches/patch-js_src_jit_FlushICache.cpp
diff -u pkgsrc/www/firefox/patches/patch-js_src_jit_FlushICache.cpp:1.2 pkgsrc/www/firefox/patches/patch-js_src_jit_FlushICache.cpp:1.3
--- pkgsrc/www/firefox/patches/patch-js_src_jit_FlushICache.cpp:1.2     Sun Aug 20 09:31:24 2023
+++ pkgsrc/www/firefox/patches/patch-js_src_jit_FlushICache.cpp Wed Jul 23 13:57:35 2025
@@ -1,8 +1,8 @@
-$NetBSD: patch-js_src_jit_FlushICache.cpp,v 1.2 2023/08/20 09:31:24 tnn Exp $
+$NetBSD: patch-js_src_jit_FlushICache.cpp,v 1.3 2025/07/23 13:57:35 ryoon Exp $
 
 NetBSD does not have the Linux-specific membarrier(2) syscall.
 
---- js/src/jit/FlushICache.cpp.orig    2023-08-15 20:31:19.000000000 +0000
+--- js/src/jit/FlushICache.cpp.orig    2025-06-13 17:08:49.000000000 +0000
 +++ js/src/jit/FlushICache.cpp
 @@ -31,12 +31,18 @@
  #    elif defined(__android__)
@@ -23,10 +23,10 @@ NetBSD does not have the Linux-specific 
  }
  
  // These definitions come from the Linux kernel source, for kernels before 4.16
-@@ -92,6 +98,8 @@ bool CanFlushExecutionContextForAllThrea
+@@ -112,6 +118,8 @@ bool CanFlushExecutionContextForAllThrea
+   MOZ_ASSERT(state != MemBarrierAvailable::Unset);
+   return state == MemBarrierAvailable::Yes;
  
-   computed = true;
-   return kernelHasMembarrier;
 +#  elif defined(__NetBSD__)
 +  return false;
  #  else

Index: pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc
diff -u pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc:1.1 
pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc:1.2
--- pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc:1.1    Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc        Wed Jul 23 13:57:35 2025
@@ -1,4 +1,4 @@
-$NetBSD: patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc,v 1.1 2025/07/15 13:58:05 ryoon Exp $
+$NetBSD: patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc,v 1.2 2025/07/23 13:57:35 ryoon Exp $
 
 --- third_party/libwebrtc/modules/audio_device/audio_device_impl.cc.orig       2025-05-21 12:45:39.616635762 +0000
 +++ third_party/libwebrtc/modules/audio_device/audio_device_impl.cc
Index: pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc
diff -u pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc:1.1 
pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc:1.2
--- pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc:1.1       Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc   Wed Jul 23 13:57:35 2025
@@ -1,4 +1,4 @@
-$NetBSD: patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc,v 1.1 2025/07/15 13:58:05 ryoon Exp $
+$NetBSD: patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc,v 1.2 2025/07/23 13:57:35 ryoon Exp $
 
 --- third_party/libwebrtc/modules/video_capture/video_capture_options.cc.orig  2025-05-21 12:41:53.782245708 +0000
 +++ third_party/libwebrtc/modules/video_capture/video_capture_options.cc
Index: pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_memory__usage.cc
diff -u pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_memory__usage.cc:1.1 pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_memory__usage.cc:1.2
--- pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_memory__usage.cc:1.1      Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_memory__usage.cc  Wed Jul 23 13:57:35 2025
@@ -1,4 +1,4 @@
-$NetBSD: patch-third__party_libwebrtc_rtc__base_memory__usage.cc,v 1.1 2025/07/15 13:58:05 ryoon Exp $
+$NetBSD: patch-third__party_libwebrtc_rtc__base_memory__usage.cc,v 1.2 2025/07/23 13:57:35 ryoon Exp $
 
 --- third_party/libwebrtc/rtc_base/memory_usage.cc.orig        2025-05-21 12:27:20.023110519 +0000
 +++ third_party/libwebrtc/rtc_base/memory_usage.cc
Index: pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc
diff -u pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc:1.1 
pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc:1.2
--- pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc:1.1    Tue Jul 15 13:58:05 2025
+++ pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc        Wed Jul 23 13:57:35 2025
@@ -1,4 +1,4 @@
-$NetBSD: patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc,v 1.1 2025/07/15 13:58:05 ryoon Exp $
+$NetBSD: patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc,v 1.2 2025/07/23 13:57:35 ryoon Exp $
 
 --- third_party/libwebrtc/rtc_base/platform_thread_types.cc.orig       2025-05-21 12:30:11.564823191 +0000
 +++ third_party/libwebrtc/rtc_base/platform_thread_types.cc