CVS commit: pkgsrc/www/firefox

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/www/firefox
From: "Ryo ONODERA" <ryoon%netbsd.org@localhost>
Date: Fri, 14 Nov 2025 17:17:18 +0000

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Fri Nov 14 17:17:18 UTC 2025

Modified Files:
        pkgsrc/www/firefox: Makefile distinfo mozilla-common.mk
        pkgsrc/www/firefox/patches:
            patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc
            patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc
Removed Files:
        pkgsrc/www/firefox/patches:
            patch-third__party_libwebrtc_system__wrappers_source_cpu__features__linux.cc

Log Message:
www/firefox: Update to 145.0

Changelog:
145.0:
New

  * Add, edit, and delete comments to make your own notes in PDFs (summaries,
    questions, tasks, etc.). The comment sidebar helps you scan all your
    comments and quickly jump to them, which is handy for long or heavily
    marked-up PDFs.

  * This version introduces a new phase of privacy protections, building on our
    research on reducing browser fingerprinting. These new defenses cut the
    percentage of users seen as unique almost in half, ensuring a safer and
    more private browsing experience in Private Browsing or when using Enhanced
    Tracking Protection set to Strict.

  * Need a reminder of what tabs are in a group? Hover over the tab group name
    to get a preview of the tabs inside without opening it.

    Tab Hover Preview Video demonstration
  * You can now access and manage your saved passwords right from the sidebar??
    no need to open a new tab or window. Stay on the page you??re on and get to
    your logins faster.

  * Copy Link to Highlight allows users to share arbitrary sections of a page
    with others by copying a link through the context menu with a given
    selection

  * The Translations feature has an improved experience when translating
    between languages with different script directions.

  * New brand-inspired wallpapers are available for New Tab on desktop, with
    versions for both light and dark mode.

  * With the new Open links from apps next to your active tab setting, you can
    have links from other applications open next to your active tab instead of
    at the end of the tab strip.

  * Enhanced Bounce Tracking Protection??s stateless mode is now enabled by
    default in ETP Strict, blocking more advanced tracking techniques based on
    redirection

  * For most Windows users, the existing desktop shortcut for launching Firefox
    has been replaced with the desktop launcher, a small program that will
    launch Firefox if it is installed, but if it is not installed will prompt
    the user to install Firefox. This will provide an easy installation point
    for Firefox users who acquire a new Windows device, where Firefox will not
    be installed by default, but the desktop launcher program may have synced
    via OneDrive or other cloud storage product. Learn more.

Fixed
  * Various security fixes.

Changed
  * Firefox no longer supports 32-bit Linux systems. We recommend installing
    the 64-bit version for continued updates and support.

  * Horizontal tabs are now slightly more rounded to match the look of vertical
    tabs. Buttons and text inputs, including the address bar, have also been
    updated for consistency.

  * When no extensions are installed, clicking the Extensions button now shows
    a message highlighting how extensions can enhance your browsing, with links
    to the Firefox Add-ons store.

  * Local translation models are now compressed with Zstandard, reducing
    download sizes and on-device storage consumption. As always, all Firefox
    translations happen securely and privately on your local device, unlike
    other browsers that translate using cloud services.

  * We updated default automation preferences to better support Agentic
    browsing, reducing the steps agents need to complete a task and chances for
    the agent to get stuck.

Web Platform

  * Support has been added for the Atomics.waitAsync proposal, which is a
    non-blocking, asynchronous version of Atomics.wait. This allow
    synchronization of threads based upon the value in a shared memory
    location, for more details please consult our MDN documentation.

  * Firefox now supports the new Integrity-Policy header for enforcing
    sub-resource integrity for scripts. Further implementation of this header
    is underway.

  * Added Matroska support for the most commonly used codecs: AVC, HEVC, VP8,
    VP9, AV1, AAC, Opus, and Vorbis.

  * The text-autospace property is now supported, allowing automatic spacing
    adjustments between characters from different scripts.

  * The WebGPU DOM API (spec; MDN) is now available on macOS 26 (Tahoe) on
    Apple Silicon. For details, see the Mozilla Graphics Team Blog.

Security fixes:
Mozilla Foundation Security Advisory 2025-87
#CVE-2025-13021: Incorrect boundary conditions in the Graphics: WebGPU
 component
#CVE-2025-13022: Incorrect boundary conditions in the Graphics: WebGPU
 component
#CVE-2025-13012: Race condition in the Graphics component
#CVE-2025-13023: Sandbox escape due to incorrect boundary conditions in the
 Graphics: WebGPU component
#CVE-2025-13016: Incorrect boundary conditions in the JavaScript: WebAssembly
 component
#CVE-2025-13024: JIT miscompilation in the JavaScript Engine: JIT component
#CVE-2025-13025: Incorrect boundary conditions in the Graphics: WebGPU
 component
#CVE-2025-13026: Sandbox escape due to incorrect boundary conditions in the
 Graphics: WebGPU component
#CVE-2025-13017: Same-origin policy bypass in the DOM: Notifications component
#CVE-2025-13018: Mitigation bypass in the DOM: Security component
#CVE-2025-13019: Same-origin policy bypass in the DOM: Workers component
#CVE-2025-13013: Mitigation bypass in the DOM: Core & HTML component
#CVE-2025-13020: Use-after-free in the WebRTC: Audio/Video component
#CVE-2025-13014: Use-after-free in the Audio/Video component
#CVE-2025-13015: Spoofing issue in Firefox
#CVE-2025-13027: Memory safety bugs fixed in Firefox 145 and Thunderbird 145


To generate a diff of this commit:
cvs rdiff -u -r1.649 -r1.650 pkgsrc/www/firefox/Makefile
cvs rdiff -u -r1.568 -r1.569 pkgsrc/www/firefox/distinfo
cvs rdiff -u -r1.302 -r1.303 pkgsrc/www/firefox/mozilla-common.mk
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/www/firefox/patches/patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc
cvs rdiff -u -r1.3 -r1.4 \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc
cvs rdiff -u -r1.2 -r0 \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_system__wrappers_source_cpu__features__linux.cc

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox/Makefile
diff -u pkgsrc/www/firefox/Makefile:1.649 pkgsrc/www/firefox/Makefile:1.650
--- pkgsrc/www/firefox/Makefile:1.649   Tue Nov  4 16:08:59 2025
+++ pkgsrc/www/firefox/Makefile Fri Nov 14 17:17:18 2025
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.649 2025/11/04 16:08:59 ryoon Exp $
+# $NetBSD: Makefile,v 1.650 2025/11/14 17:17:18 ryoon Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            144.0
-MOZ_BRANCH_MINOR=      .2
+MOZ_BRANCH=            145.0
+MOZ_BRANCH_MINOR=      
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       ${DISTNAME:S/.source//:S/b/beta/:S/esr//}

Index: pkgsrc/www/firefox/distinfo
diff -u pkgsrc/www/firefox/distinfo:1.568 pkgsrc/www/firefox/distinfo:1.569
--- pkgsrc/www/firefox/distinfo:1.568   Tue Nov  4 16:08:59 2025
+++ pkgsrc/www/firefox/distinfo Fri Nov 14 17:17:18 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.568 2025/11/04 16:08:59 ryoon Exp $
+$NetBSD: distinfo,v 1.569 2025/11/14 17:17:18 ryoon Exp $
 
-BLAKE2s (firefox-144.0.2.source.tar.xz) = 3c397c8b21d885322cf7f9d6418aafba1176b430c2e790ea879281e7a35acf4d
-SHA512 (firefox-144.0.2.source.tar.xz) = 87eebabab2c85eb32b2d1161e520f56e271a4893c8cd4d8225fc7b498a9883496315854a758478fb4edd061674a9f7c0503e9b9f0eb4503b1f89203774d02f97
-Size (firefox-144.0.2.source.tar.xz) = 646304416 bytes
+BLAKE2s (firefox-145.0.source.tar.xz) = 09b36fafe4ad2f6568816b2d764d3500be70af39c381fff10b69d3a89d496f55
+SHA512 (firefox-145.0.source.tar.xz) = 7ba40d7de95d7b93278f1823ce460b45c6bfac01eda52bc5c28f23a6bc858bdcbf8b4b4dc359b853372fffbcff4e7f0b276fefe22c2d4a0fa303e8ce1d2629be
+Size (firefox-145.0.source.tar.xz) = 649881808 bytes
 BLAKE2s (nodejs-output-144.0.tgz) = 5c8b90a5d17c56467480bdf0a8f1884d14972c8f4163d293463834721f9a4432
 SHA512 (nodejs-output-144.0.tgz) = 6bb2a8975660c68d37b09da5d3f8f0af9bd9a826ca6cb836ef41ca3e7c0c5a902e37b6cbfac5871177688fc1d808b2e07a4e0d0a705470bfa3e368053bc079fd
 Size (nodejs-output-144.0.tgz) = 248214 bytes
@@ -36,19 +36,18 @@ SHA1 (patch-modules_fdlibm_src_math__pri
 SHA1 (patch-netwerk_protocol_http_nsHttpHandler.cpp) = 67493b4635041d21ff9fbfda80b3197fed542a26
 SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = 753fd4d62088c870aefe7c4b739286259848446e
 SHA1 (patch-python_mozbuild_mozbuild_backend_recursivemake.py) = 5be4183d9075f5a3a3c6b3e0338473af185fb50e
-SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc) = 2b5955027add79d1b8709667b0433b2d19fbd1bc
+SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc) = 4691eb3ad88134c9f6336b257246f1361f6a20a7
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_vdso__support.cc) = f9c44d0d6fd952296f23c24f56053958b30d8e5c
 SHA1 (patch-third__party_js_cfworker_build.sh) = 46cdf97b99cf01080f290ae8d9a33b5f869fc3e4
 SHA1 (patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc) = 927532138175f99f96433d24060f65a2a919d2d1
 SHA1 (patch-third__party_libwebrtc_modules_desktop__capture_desktop__capture__gn_moz.build) = f53af8e5383f31b5de7df21f80eb53d60c11eae1
-SHA1 (patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc) = fc203b7a8c1557303e61cc598dc94c5cccf6f0a4
+SHA1 (patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc) = 89f8f8eb5dcb877e0c70120f742050f1b32676fb
 SHA1 (patch-third__party_libwebrtc_modules_video__capture_linux_device__info__v4l2.cc) = 8831d477f14fd4f8f735ff0c1a322cba8c70e277
 SHA1 (patch-third__party_libwebrtc_modules_video__capture_linux_video__capture__v4l2.cc) = 8111952a107eb2cd665525ddd0e27c79eee3c1cd
 SHA1 (patch-third__party_libwebrtc_modules_video__capture_video__capture__options.cc) = e15f7e365ef6d57cd262f920f49c4d73f3a13305
 SHA1 (patch-third__party_libwebrtc_rtc__base_memory__usage.cc) = a831145ba15b30d30c6e6e216b574d416253ed4a
 SHA1 (patch-third__party_libwebrtc_rtc__base_physical__socket__server.cc) = 6909c4da9e7b3785252e5bce9be0ff47ebb87e01
 SHA1 (patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc) = 8ae75100775037347008d168eedc151e0e993b0f
-SHA1 (patch-third__party_libwebrtc_system__wrappers_source_cpu__features__linux.cc) = b90e22b50879f7adcc1da3a993f52c0701b720f8
 SHA1 (patch-third__party_python_dlmanager_check.py) = 69054522d8ced8cb47e65e5a8b1a87ed5ce6708e
 SHA1 (patch-third__party_sqlite3_ext_moz.build) = 026483e9cdc61eda80b699978b1677e1b6d3ff6d
 SHA1 (patch-third__party_sqlite3_src_moz.build) = b26856a4b87aa12211575d9982f62dc899474b52

Index: pkgsrc/www/firefox/mozilla-common.mk
diff -u pkgsrc/www/firefox/mozilla-common.mk:1.302 pkgsrc/www/firefox/mozilla-common.mk:1.303
--- pkgsrc/www/firefox/mozilla-common.mk:1.302  Wed Oct 29 08:56:32 2025
+++ pkgsrc/www/firefox/mozilla-common.mk        Fri Nov 14 17:17:18 2025
@@ -1,4 +1,4 @@
-# $NetBSD: mozilla-common.mk,v 1.302 2025/10/29 08:56:32 ryoon Exp $
+# $NetBSD: mozilla-common.mk,v 1.303 2025/11/14 17:17:18 ryoon Exp $
 #
 # common Makefile fragment for mozilla packages based on gecko 2.0.
 #
@@ -22,9 +22,8 @@ OVERRIDE_DIRDEPTH=            4
 
 USE_LANGUAGES+=                c c++
 
-# XXX: As of 114.0.2
-# For nested constant initializer support in rlbox, requires 8.
-GCC_REQD+=             8
+# XXX: As of 145.0
+GCC_REQD+=             10
 
 TOOL_DEPENDS+=         cbindgen>=0.28.0:../../devel/cbindgen
 

Index: pkgsrc/www/firefox/patches/patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc
diff -u pkgsrc/www/firefox/patches/patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc:1.1 
pkgsrc/www/firefox/patches/patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc:1.2
--- pkgsrc/www/firefox/patches/patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc:1.1     Wed Apr 30 03:10:40 2025
+++ pkgsrc/www/firefox/patches/patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc Fri Nov 14 17:17:18 2025
@@ -1,10 +1,21 @@
-$NetBSD: patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc,v 1.1 2025/04/30 03:10:40 ryoon Exp $
+$NetBSD: patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc,v 1.2 2025/11/14 17:17:18 ryoon Exp $
 
 * NetBSD has no DT_GNU_HASH definition.
 
---- third_party/abseil-cpp/absl/debugging/internal/elf_mem_image.cc.orig       2025-03-05 13:29:06.318414617 +0000
+--- third_party/abseil-cpp/absl/debugging/internal/elf_mem_image.cc.orig       2025-11-06 22:07:37.000000000 +0000
 +++ third_party/abseil-cpp/absl/debugging/internal/elf_mem_image.cc
-@@ -221,6 +221,10 @@ void ElfMemImage::Init(const void *base)
+@@ -25,6 +25,10 @@
+ #include <cstddef>
+ #include <cstdint>
+ 
++#if defined(__NetBSD__)
++#include <sys/param.h>
++#endif
++
+ #include "absl/base/config.h"
+ #include "absl/base/internal/raw_logging.h"
+ 
+@@ -221,6 +225,10 @@ void ElfMemImage::Init(const void *base)
    for (; dynamic_entry->d_tag != DT_NULL; ++dynamic_entry) {
      const auto value =
          static_cast<intptr_t>(dynamic_entry->d_un.d_val) + relocation;
@@ -15,3 +26,12 @@ $NetBSD: patch-third__party_abseil-cpp_a
      switch (dynamic_entry->d_tag) {
        case DT_HASH:
          sysv_hash = reinterpret_cast<uint32_t *>(value);
+@@ -377,7 +385,7 @@ void ElfMemImage::SymbolIterator::Update
+   const ElfW(Versym) *version_symbol = image->GetVersym(index_);
+   ABSL_RAW_CHECK(symbol && version_symbol, "");
+   const char *const symbol_name = image->GetDynstr(symbol->st_name);
+-#if defined(__NetBSD__)
++#if defined(__NetBSD__) && __NetBSD_Version__ < 1199000400
+   const int version_index = version_symbol->vs_vers & VERSYM_VERSION;
+ #else
+   const ElfW(Versym) version_index = version_symbol[0] & VERSYM_VERSION;

Index: pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc
diff -u pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc:1.3 
pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc:1.4
--- pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc:1.3   Sat Jul 26 14:12:54 2025
+++ pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc       Fri Nov 14 17:17:18 2025
@@ -1,21 +1,14 @@
-$NetBSD: patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc,v 1.3 2025/07/26 14:12:54 ryoon Exp $
+$NetBSD: patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc,v 1.4 2025/11/14 17:17:18 ryoon Exp $
 
---- third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc.orig     2025-07-17 18:03:34.000000000 +0000
+--- third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc.orig     2025-10-31 13:10:50.000000000 +0000
 +++ third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc
-@@ -11,12 +11,16 @@
- #include "modules/desktop_capture/linux/wayland/egl_dmabuf.h"
- 
- #include <EGL/eglext.h>
+@@ -15,7 +15,9 @@
+ #include <EGL/eglplatform.h>
+ #include <GL/gl.h>
+ #include <GL/glext.h>
 +#if defined(__linux__)
  #include <asm/ioctl.h>
 +#endif
  #include <dlfcn.h>
  #include <fcntl.h>
- #include <gdk/gdk.h>
- #include <libdrm/drm_fourcc.h>
-+#if defined(__linux__)
- #include <linux/types.h>
-+#endif
- #include <spa/param/video/format-utils.h>
- #include <unistd.h>
- #include <xf86drm.h>
+ #include <gbm.h>

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index