CVS commit: pkgsrc/mail/thunderbird

["Ryo ONODERA" <ryoon%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Wed Jul 23 19:18:45 UTC 2025

Modified Files:
        pkgsrc/mail/thunderbird: Makefile distinfo
        pkgsrc/mail/thunderbird/patches: patch-js_src_jit_FlushICache.cpp
            patch-third__party_sqlite3_ext_moz.build

Log Message:
mail/thunderbird: Update to 140.0.1

Changelog:
140.0.1:
What's Fixed
fixed
Inserting a link into an HTML mail did not work as expected

140.0:
What's New
new
Implemented enterprise policy to allow granular in-app notification control

new
New mail alert now includes message disposition buttons

new
Added 'Mark as Read' and 'Delete' actions to mail notifications

new
Added 'Mark as Spam' and 'Mark as Starred' actions to mail notifications

new
Support dark reader for the message pane

new
Messages are automatically adapted to dark mode with a quick toggle in the header

new
Message filters are now available in the Folder Pane context menu

new
Added horizontal threadpane scrolling mail.threadpane.table.horizontal_scroll

new
Implemented customizable row count for Cards View in 'Appearance' settings

new
Implemented ability to manually sort folders in the folder pane

new
New "Appearance" Settings UI to globally control message threading/sorting order

new
Added checkbox to select/unselect all calendars in the calendar setup wizard

new
Account Hub enabled by default for second email setup

new
Add-ons: Added support for specifying a cookieStoreId when creating a space

new
Added Thunderbird-specific loading symbol

What's Changed
changed
Removed obsolete preference extensions.overlayloader.loglevel

changed
CardDAV address books and calendars now use the same OAuth2 code as mail

changed
Display junk state and allow toggling it from top of message context menu

changed
Subscribe/Unsubscribe buttons were removed from the IMAP subscribe dialog

changed
Ignore unsupported subkeys/signatures when importing compliant OpenPGP keys

changed
Some generic appearance settings were moved from General to Appearance section

changed
Add-ons: browser.messages.listAttachments() now returns attachment headers

changed
Set calendar.alarms.showmissed preference to false by default

changed
Exporting a calendar to .ics did not include the calendar name

What's Fixed
fixed
Chrome URLs were opened in an external browser

fixed
Race condition in folder compaction could cause unexpected behavior

fixed
Crash could occur when shutting down during MAPI send

fixed
Message preview truncation in notifications improved

fixed
Thunderbird could crash when setting message compose headers

fixed
Links in the OAuth authentication window did not open when clicked

fixed
Mail window could stop functioning during and after folder compaction

fixed
Error message for compacting a corrupted local folder was not useful

fixed
Repair folder did not fix mbox files produced on MacOS before Thunderbird 1.0

fixed
Wrong day of week displayed for some emails

fixed
Edit menu entries missing when group header selected in "Grouped by sort" view

fixed
IMAP folder "Undelete" performed "Delete" when mixed messages were selected

fixed
View Message Source no longer worked for multiple selected messages

fixed
Creating a new mail account from the menu bar in a message window failed

fixed
Feed subscriptions were broken

fixed
Feed body was not rendered when "Message Body As" formatting option selected

fixed
Thunderbird could show incorrect 'From' and 'To' fields for mailing list emails

fixed
mail.compose.other.header wrongly added fields to message preview pane headers

fixed
Deleting or detaching attachments in a saved .eml file appeared to work but failed

fixed
In RSS feeds, the space bar did not scroll the message like it did in emails

fixed
Unchecking "Show all headers" in Message Header Settings closed dialog

fixed
Some webpage links could be forced to open in Thunderbird

fixed
Right-click of message in cross-folder virtual folder wrongly selected it

fixed
Messages deleted from a cross-folder search view could not be undeleted

fixed
Cards view "replies" button remained styled without new messages in thread

fixed
Subscribe window "Show items that contain" should not have been shown for IMAP

fixed
POP3 inbox could show new mail with no subject, no sender, and date 1970-01-01

fixed
Folders at level 3+ were not auto-discovered when IMAP subscriptions were ignored

fixed
New subfolder did not inherit parent view, sort order, sort type, or columns

fixed
With "Fetch headers only" enabled, messages could not be sorted by size

fixed
Selecting starred messages did not update immediately

fixed
Marking a unified folder as favorite did not show it in favorite folders

fixed
Threaded search view was not updated correctly when sorted by date received

fixed
Menu items to manage folders were not disabled in offline mode

fixed
Ctrl or Shift selecting multiple messages reset when dragging across a message

fixed
Folder was hidden from Favorite when subfolder was removed

fixed
Folder tree message counts displayed incorrectly under certain conditions

fixed
The UI could falsely report a message as encrypted when a null cipher was used

fixed
Message security panel strings were used in the wrong places

fixed
Importing an OpenPGP public key with whitespace failed

fixed
Unable to open attached signed OpenPGP .eml message

fixed
OpenPGP key was not updated when accepted key was reimported with new identities

fixed
Dual signed (PGP and S/MIME) emails were not displayed

fixed
"Secret Key ID" field did not sanitize input, causing draft encryption to fail

fixed
Could not send signed/encrypted messages in some setups due to regression

fixed
Quick Filter did not display loading symbol when search was in progress

fixed
Search messages dialog list could not be sd for search after repair

fixed
Messages with multiple authors or no author were not indexed for global search

fixed
Messages from authors without email address were not indexed for global search

fixed
Shutdown could hang due to unterminated search exelected text did not work with advanced properties selected

fixed
Spellcheck no longer highlighted misspelled words in the compose window

fixed
Changing the UI font size did not apply to some dialogs

fixed
Deleted Gmail messages stayed visible until comned visible when mail.chat.enabled was false

fixed
macOS system notifications worked but email alerts could not be disabled separately

fixed
Setting different archiving options for multiple identities did not work

fixed
OAuth2 not shown in "Authentication method" menulist for existing Exchange account

fixed
'Please fill out this field' in account setup always appeared in English

fixed
No gap existed between Back and Forward buttons in the Feed Account Wizard dialog

fixed
Moving back in the calendar import dialog could break the Continue button

fixed
Add-ons: Links in content pages with a target attribute loaded a blank page

fixed
Add-ons: Context menu entries were incorrectly aligned.

fixed
Add-ons: Optional permission prompts for WebExtensions displayed wrong permissions

fixed
Double clicking a new contact icon added the contact to the address book twice

fixed
Unable to auto-discover Address Book on Radicale server

fixed
CardDAV synchronization to Zimbra server failed

fixed
Mark-Of-The-Web was not applied to attachments saved via drag and drop

fixed
System search toggle did not properly reflect and control integration state

fixed
Some messages could not be scrolled due to hidden overflows in inline styles

fixed
Keyboard navigation was not possible when first header button was disabled

fixed
Thunderbird could crash when renaming a local folder while copying from IMAP

fixed
Some functionality was missing for newsgroup messages opened from a file or URI

fixed
Message and folder lists could display incorrect line spacing after restart

fixed
Automatic compact did not attempt to compact all folders when error encountered

fixed
APOP authenication for POP3 did not prompt for corrected password

fixed
POP3 'fetch headers only' and 'get selected messages' could skip some messages

fixed
Thunderbird logged network errors in console when used in offline mode

fixed
Slow performance when moving bulk messages from IMAP to local

fixed
Crossposting news article was not possible if newsgroups on different servers

fixed
Cancelling a post to a news server could fail and remove the article

fixed
Thunderbird could crash in NNTP subscription dialog

fixed
Newsgroup searches with slashes were not supported with XPAT-enabled servers

fixed
Offline newsgroup use lacked functionality needed for effective offline access

fixed
Thunderbird could show a misleading error message on IMAP login failure

fixed
Modal alerts shown for expired articles when downloading news for offline use

fixed
Status bar message did not include newsgroup name along with the account name

fixed
Reconnecting to an NNTP server was potentially not possible

fixed
Nickserv messages appeared during successful authentication

fixed
Thunderbird Flatpak install did not use a branded symbolic icon

fixed
Unable to view full certificate chain from the "View Signature" button

fixed
Organizer email address for CalDAV calendar events could be incorrect

fixed
Changing calendar.week.start preference did not update calendar views

fixed
Clicking a mid: link in Calendar opened two copies of the message

fixed
Clicking a 'mid:' link in event created from message did not work

fixed
Thunderbird calendar failed to show attendee as busy when added to an event

fixed
Some calendar requests were blocked due to opaque response blocking

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2025-54
#CVE-2025-6424: Use-after-free in FontFaceSet
#CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID
#CVE-2025-6426: No warning when opening executable terminal files on macOS
#CVE-2025-6427: connect-src Content Security Policy restriction could be bypassed
#CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com
#CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag
#CVE-2025-6432: DNS Requests leaked outside of a configured SOCKS proxy
#CVE-2025-6433: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate
#CVE-2025-6434: HTTPS-Only exception screen lacked anti-clickjacking delay
#CVE-2025-6435: Save as in Devtools could download files without sanitizing the extension
#CVE-2025-6436: Memory safety bugs fixed in Firefox 140 and Thunderbird 140

139.0.2:
What's Fixed
fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2025-50
#CVE-2025-5986: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

139.0.1:
What's Fixed
fixed
Thunderbird could crash when copying a local folder to IMAP

fixed
Upgrade to 139.0 incorrectly switched Table View to Cards View

139.0:
What's New
new
Implemented enterprise policy to allow granular in-app notification control

new
Added 'Mark as Read' and 'Delete' actions to mail notifications

new
Implemented customizable row count for Cards View in 'Appearance' settings

new
Implemented ability to manually sort folders in the folder pane

What's Fixed
fixed
Thunderbird could crash when setting message compose headers

fixed
Links in the OAuth authentication window did not open when clicked

fixed
Access was not allowed to attachments at specific UNC hosts

fixed
Mail window could stop functioning during and after folder compaction

fixed
Full folder sorting logic was not used when inserting folders after move

fixed
mail.compose.other.header headers were not shown in Show All Headers mode

fixed
Folder was hidden from Favorite when a subfolder was removed

fixed
Folder tree message counts displayed incorrectly under certain conditions

fixed
Selection was not restored after manual folder sorting

fixed
Dragging a folder to a new parent did not insert it correctly for IMAP folders

fixed
Compact View users had all folders expanded after restart

fixed
Invite attachments without a name were forwarded as 'Attached Message Part'

fixed
Chat settings tab remained visible when mail.chat.enabled was false

fixed
Selected folder was not refreshed when applying 'Appearance' Threading settings

fixed
'Grouped by Sort' for all folders in 'Appearance' settings did not work properly

fixed
Thunderbird could crash if message copying to Sent folder was interrupted

fixed
System search toggle did not properly reflect and control integration state

fixed
Dragging attachments to desktop from Thunderbird did not work on macOS

fixed
Dark mode messages displayed in light mode due to preference setting conflict

fixed
Cancelling a post to a news server could fail and remove the article

fixed
Thunderbird could crash in NNTP subscription dialog

fixed
Newsgroup searches with slashes were not supported with XPAT-enabled servers

fixed
Offline newsgroup use lacked functionality needed for effective offline access

fixed
Chat accounts could not be deleted

fixed
Reminders missed for all-day events when calendar.alarms.showmissed was false

fixed
Access to multiple CalDAV calendars was not possible

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2025-45
#CVE-2025-5262: Double-free in libvpx encoder
#CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content
#CVE-2025-5264: Potential local code execution in "Copy as cURL" command
#CVE-2025-5265: Potential local code execution in "Copy as cURL" command
#CVE-2025-5270: SNI was sometimes unencrypted
#CVE-2025-5271: Devtools' preview ignored CSP headers
#CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved payment card details
#CVE-2025-5268: Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11
#CVE-2025-5272: Memory safety bugs fixed in Firefox 139 and Thunderbird 139

138.0.2:
What's Fixed
fixed
Messages could not be viewed if the profile used a UNC path

fixed
Standalone message windows/tabs no longer responded after folder compaction

fixed
Compacting folders with certain pending operations caused unnecessary warnings

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2025-41
#CVE-2025-4918: Out-of-bounds access when resolving Promise objects
#CVE-2025-4919: Out-of-bounds access when optimizing linear sums


To generate a diff of this commit:
cvs rdiff -u -r1.344 -r1.345 pkgsrc/mail/thunderbird/Makefile
cvs rdiff -u -r1.283 -r1.284 pkgsrc/mail/thunderbird/distinfo
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/mail/thunderbird/patches/patch-js_src_jit_FlushICache.cpp
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/mail/thunderbird/patches/patch-third__party_sqlite3_ext_moz.build

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/thunderbird/Makefile
diff -u pkgsrc/mail/thunderbird/Makefile:1.344 pkgsrc/mail/thunderbird/Makefile:1.345
--- pkgsrc/mail/thunderbird/Makefile:1.344      Sun May 18 00:54:58 2025
+++ pkgsrc/mail/thunderbird/Makefile    Wed Jul 23 19:18:45 2025
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.344 2025/05/18 00:54:58 ryoon Exp $
+# $NetBSD: Makefile,v 1.345 2025/07/23 19:18:45 ryoon Exp $
 
 DISTNAME=      thunderbird-${TB_VER}.source
 PKGNAME=       thunderbird-${TB_VER:S/esr//}
-TB_VER=                138.0.1
+TB_VER=                140.0.1
 CATEGORIES=    mail
 MASTER_SITES=  ${MASTER_SITE_MOZILLA:=thunderbird/releases/${TB_VER}/source/}
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/mail/thunderbird/distinfo
diff -u pkgsrc/mail/thunderbird/distinfo:1.283 pkgsrc/mail/thunderbird/distinfo:1.284
--- pkgsrc/mail/thunderbird/distinfo:1.283      Sun May 18 00:54:58 2025
+++ pkgsrc/mail/thunderbird/distinfo    Wed Jul 23 19:18:45 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.283 2025/05/18 00:54:58 ryoon Exp $
+$NetBSD: distinfo,v 1.284 2025/07/23 19:18:45 ryoon Exp $
 
-BLAKE2s (thunderbird-138.0.1.source.tar.xz) = f7c611e3704cdb446685ca28dd10932333f32016d775c52cd4fc17b5daea4cce
-SHA512 (thunderbird-138.0.1.source.tar.xz) = 2e71ee537292ec1a49237e93c43ed4c1a9eae58becfc7fa9ca0daf1e982c38704cb6d44e92b1bf7b45c5b8c27b23eb3aa7f48b375580f49ee60884dadc5d85b5
-Size (thunderbird-138.0.1.source.tar.xz) = 758760604 bytes
+BLAKE2s (thunderbird-140.0.1.source.tar.xz) = 0bc683bc0878780bc5dec5e029d03f5f6a61b5a0bab7570f35ba7c57b6d93c34
+SHA512 (thunderbird-140.0.1.source.tar.xz) = fbef1d0228c49fc9c11425b6be03bb7e44e6abc6f2027ee23317270ca2c6b0a935bb41b38667acf014bd9e1166cbe62754f1e919e04f2355dc4c833e015c78b8
+Size (thunderbird-140.0.1.source.tar.xz) = 760372872 bytes
 SHA1 (patch-browser_app_profile_firefox.js) = bc719edef37d18655ba79b030270438ee166fdaf
 SHA1 (patch-build_moz.configure_init.configure) = 65deb3c233df0aab81eb1fca05d708e5a4ed169a
 SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
@@ -20,7 +20,7 @@ SHA1 (patch-ipc_chromium_src_base_platfo
 SHA1 (patch-ipc_glue_GeckoChildProcessHost.cpp) = 63fbee04321f7ade20db4ccc1a1218b848344ce1
 SHA1 (patch-js-src-jit-arm64-vixl-MozCpu-vixl.cpp) = d90fca47d79551fd74214d47f8184670b901b792
 SHA1 (patch-js_public_Utility.h) = bb5464a0398b91693ab362e6b9b06d48429b9e7d
-SHA1 (patch-js_src_jit_FlushICache.cpp) = d1e611eaf7d7be22abfac6b39fbcd99df3570e47
+SHA1 (patch-js_src_jit_FlushICache.cpp) = f5d1fcb391c36a29fb71a78dbf731ee6a1cb17b6
 SHA1 (patch-js_src_old-configure.in) = adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
 SHA1 (patch-js_src_util_NativeStack.cpp) = a0a16d8d8d78d3cc3f4d2a508586f1a7821f7dba
 SHA1 (patch-js_src_vm_TypedArrayObject-inl.h) = e7913c8d4b2b05b67040baa64dae62d6ba40390e
@@ -41,7 +41,7 @@ SHA1 (patch-third__party_libwebrtc_modul
 SHA1 (patch-third__party_libwebrtc_rtc__base_physical__socket__server.cc) = 6909c4da9e7b3785252e5bce9be0ff47ebb87e01
 SHA1 (patch-third__party_libwebrtc_system__wrappers_source_cpu__features__linux.cc) = b90e22b50879f7adcc1da3a993f52c0701b720f8
 SHA1 (patch-third__party_python_dlmanager_check.py) = 69054522d8ced8cb47e65e5a8b1a87ed5ce6708e
-SHA1 (patch-third__party_sqlite3_ext_moz.build) = 2df374daa1c974b52db602613508e4fc965a7bcd
+SHA1 (patch-third__party_sqlite3_ext_moz.build) = 53248ac4ba98983362b173d7644f1001f5127b3c
 SHA1 (patch-third__party_sqlite3_src_moz.build) = b26856a4b87aa12211575d9982f62dc899474b52
 SHA1 (patch-third__party_wasm2c_src_prebuilt_wasm2c__source__includes.cc) = 99d0db944f0c2d0c623460991efd423d9127c988
 SHA1 (patch-toolkit_components_terminator_nsTerminator.cpp) = e905e38ef1b88d764c695c019f15609350c1c43b

Index: pkgsrc/mail/thunderbird/patches/patch-js_src_jit_FlushICache.cpp
diff -u pkgsrc/mail/thunderbird/patches/patch-js_src_jit_FlushICache.cpp:1.2 pkgsrc/mail/thunderbird/patches/patch-js_src_jit_FlushICache.cpp:1.3
--- pkgsrc/mail/thunderbird/patches/patch-js_src_jit_FlushICache.cpp:1.2        Wed Apr 30 03:47:13 2025
+++ pkgsrc/mail/thunderbird/patches/patch-js_src_jit_FlushICache.cpp    Wed Jul 23 19:18:45 2025
@@ -1,8 +1,8 @@
-$NetBSD: patch-js_src_jit_FlushICache.cpp,v 1.2 2025/04/30 03:47:13 ryoon Exp $
+$NetBSD: patch-js_src_jit_FlushICache.cpp,v 1.3 2025/07/23 19:18:45 ryoon Exp $
 
 NetBSD does not have the Linux-specific membarrier(2) syscall.
 
---- js/src/jit/FlushICache.cpp.orig    2023-08-15 20:31:19.000000000 +0000
+--- js/src/jit/FlushICache.cpp.orig    2025-06-13 17:08:49.000000000 +0000
 +++ js/src/jit/FlushICache.cpp
 @@ -31,12 +31,18 @@
  #    elif defined(__android__)
@@ -23,10 +23,10 @@ NetBSD does not have the Linux-specific 
  }
  
  // These definitions come from the Linux kernel source, for kernels before 4.16
-@@ -92,6 +98,8 @@ bool CanFlushExecutionContextForAllThrea
+@@ -112,6 +118,8 @@ bool CanFlushExecutionContextForAllThrea
+   MOZ_ASSERT(state != MemBarrierAvailable::Unset);
+   return state == MemBarrierAvailable::Yes;
  
-   computed = true;
-   return kernelHasMembarrier;
 +#  elif defined(__NetBSD__)
 +  return false;
  #  else

Index: pkgsrc/mail/thunderbird/patches/patch-third__party_sqlite3_ext_moz.build
diff -u pkgsrc/mail/thunderbird/patches/patch-third__party_sqlite3_ext_moz.build:1.1 pkgsrc/mail/thunderbird/patches/patch-third__party_sqlite3_ext_moz.build:1.2
--- pkgsrc/mail/thunderbird/patches/patch-third__party_sqlite3_ext_moz.build:1.1        Wed Apr 30 03:47:13 2025
+++ pkgsrc/mail/thunderbird/patches/patch-third__party_sqlite3_ext_moz.build    Wed Jul 23 19:18:45 2025
@@ -1,9 +1,9 @@
-$NetBSD: patch-third__party_sqlite3_ext_moz.build,v 1.1 2025/04/30 03:47:13 ryoon Exp $
+$NetBSD: patch-third__party_sqlite3_ext_moz.build,v 1.2 2025/07/23 19:18:45 ryoon Exp $
 
---- third_party/sqlite3/ext/moz.build.orig     2024-08-06 01:06:04.545236415 +0000
+--- third_party/sqlite3/ext/moz.build.orig     2025-07-02 01:08:50.000000000 +0000
 +++ third_party/sqlite3/ext/moz.build
-@@ -20,7 +20,7 @@ SOURCES += [
-     "fts5.c",
+@@ -21,7 +21,7 @@ SOURCES += [
+     "sqlite-vec/sqlite-vec.c",
  ]
  
 -if CONFIG["OS_TARGET"] == "Linux" or CONFIG["OS_TARGET"] == "Android":