CVS commit: pkgsrc/www/firefox

["Ryo ONODERA" <ryoon%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Thu Jul 16 13:11:49 UTC 2026

Modified Files:
        pkgsrc/www/firefox: Makefile PLIST distinfo mozilla-common.mk
        pkgsrc/www/firefox/files: node-wrapper.sh
        pkgsrc/www/firefox/patches: patch-browser_app_profile_firefox.js
            patch-python_sites_mach.txt
Added Files:
        pkgsrc/www/firefox/patches:
            patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp
            patch-third__party_rust_mtu_src_bindings_netbsd.rs

Log Message:
www/firefox: Update to 152.0.6

* WebGL does not work. webgl.out-of-process workaround was removed.
  Disable WebGL by default.

Cnangelog:
152.0.6:
New
  * Smart Window includes several enhancements:

Fixed

  * Fixed an issue that prevented email tracking protection from being disabled
    in the redesigned Firefox Settings. (Bug 2049331)

  * Fixed a hang that could occur after using a file picker dialog on macOS 26.
    (Bug 2053177)

  * Fixed the homepage not loading for some enterprise configurations that set
    it using a legacy autoconfig format. (Bug 2047962)

  * Various security fixes.

Security fixes:
Mozilla Foundation Security Advisory 2026-67
#CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
#CVE-2026-15719: Site isolation in the DOM: Navigation component

152.0.5:
Fixed

  * Fixed the Manage payment methods list in Settings appearing empty when a
    saved payment card had no expiration date. (Bug 2048383)

152.0.4:
New

  * Smart Window includes several enhancements:

      + You can now ask it to close your tabs, with a confirmation step when
        needed and the option to undo afterward. (Bug 2040769)
      + Browsing history results now appear with images. (Bug 2038069)
      + When you give feedback on a response, you can now choose from common
        reasons and preview exactly what will be shared before submitting. (Bug
        2033002)

Fixed

  * Fixed copy, paste, undo, redo, and similar keyboard shortcuts not working
    inside macOS system dialogs such as the Save and Open panels. (Bug 2040851,
    Bug 2040844)

  * Fixed the Manage Cookies and Site Data dialog opening with an empty list
    when opened from the Settings search results. (Bug 2041077)

  * Fixed keyboard focus landing in the wrong place after following an in-page
    link, so pressing Tab continues from the link's position as expected. (Bug
    2049307)

  * Various security fixes.

Security fixes:
Mozilla Foundation Security Advisory 2026-62
#CVE-2026-14241: Memory safety bugs fixed in Firefox 152.0.4

152.0.3:
Fixed

  * Fixed an issue that could cause extreme memory usage and freezing on
    startup for users with language packs installed. (Bug 2049845)

152.0.2:
Fixed

  * Fixed some Settings section headings showing placeholder text instead of
    the translated name in certain languages. (Bug 2047983)

  * Fixed New Tab content not matching the browser's display language after it
    was changed. (Bug 2046945)

  * Fixed a regression that could break playback of some MP4 video files. (Bug
    2047467)

  * Fixed a performance regression that could slow down sites performing many
    encryption and decryption operations at once, such as Proton Drive. (Bug
    2046401)

152.0.1:
Fixed

  * Fixed frequent crashes affecting users with Intel Raptor Lake processors. (
    Bug 2039575)

  * Fixed an issue on macOS where choosing a PDF option, such as "Save as PDF",
    from the system print dialog would send the job to your printer instead of
    saving a file. (Bug 2047850)

152.0:
New

  * Firefox Settings features a brand-new look with streamlined organization,
    clearer groupings, and improved navigation for easier customization.

  * In Private Browsing windows, you can now temporarily disable tracker
    blocking for a tab if it's causing a site to break. When you reload a page
    where trackers were blocked, Firefox shows a message offering to reload
    without the stricter protections. All other tracking protections stay
    active.

  * You can now mute your browser from the address bar: type "mute" (or "shush"
    or "sssh") and use the address bar quick action to silence every tab
    currently playing sound across all Firefox windows.

  * Improved support for more advanced cursor movement commands, including
    those relating to paragraph boundaries, on macOS.

  * On Windows and Linux, you can now copy links via the tab context menu by
    right-clicking a tab and selecting Share > Copy Link, making it easy to
    copy a link without switching to the tab first. When multiple tabs are
    selected, you can copy all selected links at once. Windows users still
    retain access to Microsoft sharing options from the Share menu.

  * A "Send tab" toolbar button is now available which can be added via More
    Tools > Customize Toolbar.

  * The following languages are now available for Translations:

      + Basque
      + Galician
  * Firefox builds in Croatian, English (UK), Georgian, Persian, Slovenian,
    Tajik, Tamil, Tibetan, Turkish, Welsh, and Xhosa now come with a built-in
    dictionary for the Firefox spellchecker.

Firefox Labs

  * Firefox now offers experimental support for the new JPEG XL image format,
    which generally provides better compression than WebP, JPEG, PNG, and GIF
    and is designed to supersede them. You can enable it from the Firefox Labs
    panel in Settings.

Fixed

  * Fixed an issue where the Paste option could be missing from context menus
    when editing content on sites such as Squarespace, LinkedIn, and eBay.

  * Improved dragging images from Firefox to the desktop or Finder on macOS ??
    images now save reliably and land where you drop them.

  * In multiple monitor situations, the About Firefox window now more reliably
    opens on the display with the most recently used Firefox window.

  * Fixed arrow-key text navigation and word selection commands that moved in
    the wrong direction in right-to-left text on macOS and Linux.

  * Various security fixes.

Security fixes:
Mozilla Foundation Security Advisory 2026-57
#CVE-2026-12289: Privilege escalation in the Graphics: WebRender component
#CVE-2026-12290: Memory safety bug fixed in Firefox 152
#CVE-2026-12291: Use-after-free in the Networking: HTTP component
#CVE-2026-12292: Incorrect boundary conditions in the Web Audio component
#CVE-2026-12293: Use-after-free in the Graphics: WebGPU component
#CVE-2026-12294: Sandbox escape in the DOM: Workers component
#CVE-2026-12295: Sandbox escape in the DOM: Navigation component
#CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component
#CVE-2026-12297: Sandbox escape due to incorrect boundary conditions in the
 Networking component
#CVE-2026-12298: Memory safety bug fixed in Firefox 152
#CVE-2026-12299: JIT miscompilation in the DOM: Core & HTML component
#CVE-2026-12300: Memory safety bug fixed in Firefox 152
#CVE-2026-12301: Memory safety bug fixed in Firefox 152
#CVE-2026-12302: Mitigation bypass in the DOM: Security component
#CVE-2026-12303: Information disclosure due to incorrect boundary conditions in
 the Graphics: WebGPU component
#CVE-2026-12304: Same-origin policy bypass in the Networking: Cookies component
#CVE-2026-12305: Memory safety bug fixed in Firefox 152
#CVE-2026-12306: Memory safety bug fixed in Firefox 152
#CVE-2026-12307: Memory safety bug fixed in Firefox 152
#CVE-2026-12308: Memory safety bug fixed in Firefox 152
#CVE-2026-12309: Memory safety bug fixed in Firefox 152
#CVE-2026-12310: Memory safety bug fixed in Firefox 152
#CVE-2026-12311: Information disclosure, sandbox escape in the Security:
 Process Sandboxing component
#CVE-2026-12312: Memory safety bug fixed in Firefox 152
#CVE-2026-12313: Information disclosure, sandbox escape in the Security:
 Process Sandboxing component
#CVE-2026-12314: Memory safety bug fixed in Firefox 152
#CVE-2026-12315: Mitigation bypass in the DOM: Security component
#CVE-2026-12316: Mitigation bypass in the DOM: Security component
#CVE-2026-12317: Memory safety bug fixed in Firefox 152
#CVE-2026-12318: Incorrect boundary conditions in the Libraries component in
 NSS
#CVE-2026-12319: Denial-of-service in the Audio/Video: Playback component
#CVE-2026-12320: Information disclosure in the Password Manager component
#CVE-2026-12321: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-12322: Clickjacking issue in the Widget: Gtk component
#CVE-2026-12323: Spoofing issue in the DOM: Core & HTML component
#CVE-2026-12324: Incorrect boundary conditions in the Graphics: CanvasWebGL
 component
#CVE-2026-12325: Denial-of-service in the Graphics: ImageLib component
#CVE-2026-12326: Memory safety bugs fixed in Firefox 152 and Thunderbird 152


To generate a diff of this commit:
cvs rdiff -u -r1.664 -r1.665 pkgsrc/www/firefox/Makefile
cvs rdiff -u -r1.191 -r1.192 pkgsrc/www/firefox/PLIST
cvs rdiff -u -r1.583 -r1.584 pkgsrc/www/firefox/distinfo
cvs rdiff -u -r1.315 -r1.316 pkgsrc/www/firefox/mozilla-common.mk
cvs rdiff -u -r1.39 -r1.40 pkgsrc/www/firefox/files/node-wrapper.sh
cvs rdiff -u -r1.24 -r1.25 \
    pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/www/firefox/patches/patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp \
    pkgsrc/www/firefox/patches/patch-third__party_rust_mtu_src_bindings_netbsd.rs
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/www/firefox/patches/patch-python_sites_mach.txt

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox/Makefile
diff -u pkgsrc/www/firefox/Makefile:1.664 pkgsrc/www/firefox/Makefile:1.665
--- pkgsrc/www/firefox/Makefile:1.664   Mon Jul 13 04:36:34 2026
+++ pkgsrc/www/firefox/Makefile Thu Jul 16 13:11:48 2026
@@ -1,18 +1,17 @@
-# $NetBSD: Makefile,v 1.664 2026/07/13 04:36:34 wiz Exp $
+# $NetBSD: Makefile,v 1.665 2026/07/16 13:11:48 ryoon Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            151.0
-MOZ_BRANCH_MINOR=      .2
+MOZ_BRANCH=            152.0
+MOZ_BRANCH_MINOR=      .6
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       ${DISTNAME:S/.source//:S/b/beta/:S/esr//}
-PKGREVISION=   2
 CATEGORIES=    www
 MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}
 EXTRACT_SUFX=  .tar.xz
 
-NODEJSKIT=             nodejs-output-151.0.2.tgz
+NODEJSKIT=             nodejs-output-152.0.5.tgz
 DISTFILES=             ${DEFAULT_DISTFILES} ${NODEJSKIT}
 SITES.${NODEJSKIT}=    ${MASTER_SITE_LOCAL}
 

Index: pkgsrc/www/firefox/PLIST
diff -u pkgsrc/www/firefox/PLIST:1.191 pkgsrc/www/firefox/PLIST:1.192
--- pkgsrc/www/firefox/PLIST:1.191      Mon Oct 27 14:24:32 2025
+++ pkgsrc/www/firefox/PLIST    Thu Jul 16 13:11:48 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.191 2025/10/27 14:24:32 ryoon Exp $
+@comment $NetBSD: PLIST,v 1.192 2026/07/16 13:11:48 ryoon Exp $
 bin/firefox
 lib/firefox/application.ini
 lib/firefox/browser/chrome/icons/default/default128.png
@@ -30,6 +30,7 @@ lib/firefox/platform.ini
 lib/firefox/removed-files
 ${PLIST.v4l2_decode}lib/firefox/v4l2test
 lib/firefox/vaapitest
+lib/firefox/vulkantest
 share/applications/firefox.desktop
 share/icons/hicolor/128x128/apps/firefox.png
 share/icons/hicolor/16x16/apps/firefox.png

Index: pkgsrc/www/firefox/distinfo
diff -u pkgsrc/www/firefox/distinfo:1.583 pkgsrc/www/firefox/distinfo:1.584
--- pkgsrc/www/firefox/distinfo:1.583   Thu Jul  9 20:07:10 2026
+++ pkgsrc/www/firefox/distinfo Thu Jul 16 13:11:48 2026
@@ -1,12 +1,12 @@
-$NetBSD: distinfo,v 1.583 2026/07/09 20:07:10 jklos Exp $
+$NetBSD: distinfo,v 1.584 2026/07/16 13:11:48 ryoon Exp $
 
-BLAKE2s (firefox-151.0.2.source.tar.xz) = f222da7bbef5f86e1b21395c46f39a3f6c05cc2d9ca19c1280738dd6e7b59ff8
-SHA512 (firefox-151.0.2.source.tar.xz) = 87308953ed354a2799a9a45be40033bf9ff8d80fa220f034aacfbd6e754716901d4164c37fa56032c659b259116603e0ba2b566c1f3651ab9cc0835d502cd739
-Size (firefox-151.0.2.source.tar.xz) = 784076112 bytes
-BLAKE2s (nodejs-output-151.0.2.tgz) = 3fcfc5072cb31b2e5fbdbd78178700ee6eac110e2a1070e29dec5ce62ce851b4
-SHA512 (nodejs-output-151.0.2.tgz) = 49bcb42140037e512ecf15889bcca4cd59f67f3bebacdf781b52afd6a2f87770baf340052f786aed80146ba649a8409d6cf5d61963867577099b3c3cb3fa0847
-Size (nodejs-output-151.0.2.tgz) = 248196 bytes
-SHA1 (patch-browser_app_profile_firefox.js) = 1eaa674c0aa8279e2f9dc2eda582650a08156d65
+BLAKE2s (firefox-152.0.6.source.tar.xz) = 825eccafa3d1b7735f684b375d7cda3420f31014c7e728f8a9450be3835318cf
+SHA512 (firefox-152.0.6.source.tar.xz) = c4d877837d7007fb611c38d49d9b6dd3bc4c5c9ca900b54e722e140ce7ecd0924f69b5cedc7f8c1fe602e7efe1d7159b019de27999e29235cd631821bb13e6b0
+Size (firefox-152.0.6.source.tar.xz) = 801138984 bytes
+BLAKE2s (nodejs-output-152.0.5.tgz) = 2023698e3d888d3d9cf69929ddbe8906317a48ab364c07047d13aaa40cc5ef89
+SHA512 (nodejs-output-152.0.5.tgz) = 11ddf7c07affd1597706f24164984406215d79ab0c6bbf25532b3d54ce4a061073434b808e3525bb3a5e8852ad380fb8918282bef6401a5cde54e8402cb4285d
+Size (nodejs-output-152.0.5.tgz) = 248204 bytes
+SHA1 (patch-browser_app_profile_firefox.js) = 44c1fe360411e5946824aa4c814eaf5929e3648d
 SHA1 (patch-build_gn__processor.py) = 078f773104bf4c1b30584564aefe365db6ba6daf
 SHA1 (patch-build_moz.configure_init.configure) = 65deb3c233df0aab81eb1fca05d708e5a4ed169a
 SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
@@ -15,6 +15,7 @@ SHA1 (patch-config_makefiles_rust.mk) = 
 SHA1 (patch-config_system-headers.mozbuild) = 8a628765291085efe6a22da28c0ff99fbc3c5e6f
 SHA1 (patch-dom_base_nsAttrName.h) = ac7ba441a3b27df2855cf2673eea36b1cb44ad49
 SHA1 (patch-dom_media_mediacapabilities_MediaCapabilitiesValidation.cpp) = b7f8d8b82e4545b97643fbbea7fa72a4cc2ecaf8
+SHA1 (patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp) = 997e33cc1e28c624e8e24702e6009fe1c98dab88
 SHA1 (patch-dom_media_webrtc_libwebrtc__overrides_moz.build) = a2ff7cf1e6aaf888ee78581d89c7e658f46c3fcd
 SHA1 (patch-dom_webtransport_api_WebTransportDatagramDuplexStream.cpp) = b93b4c6367bd2fb3d1868ab7d97ca56c100be414
 SHA1 (patch-gfx_angle_checkout_src_common_third__party_smhasher_src_PMurHash.cpp) = e458c9c8dc66edc69c1874734af28a77fc5e3993
@@ -40,7 +41,7 @@ SHA1 (patch-netwerk_protocol_http_nsHttp
 SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = 753fd4d62088c870aefe7c4b739286259848446e
 SHA1 (patch-python_mozbuild_mozbuild_backend_recursivemake.py) = 5be4183d9075f5a3a3c6b3e0338473af185fb50e
 SHA1 (patch-python_sites_build.txt) = f60f28480179edb47c8dcf84e3247aa6704c2610
-SHA1 (patch-python_sites_mach.txt) = a4950e1b5ad66231b723eef8f9e7ecce9127d9d3
+SHA1 (patch-python_sites_mach.txt) = f1568a4a7e65a6811e97f8c9c76148c9cdb7e02a
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc) = b1067a6804470f7e365f347683b7d505853fd799
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_vdso__support.cc) = f9c44d0d6fd952296f23c24f56053958b30d8e5c
 SHA1 (patch-third__party_js_cfworker_build.sh) = 46cdf97b99cf01080f290ae8d9a33b5f869fc3e4
@@ -56,6 +57,7 @@ SHA1 (patch-third__party_libwebrtc_rtc__
 SHA1 (patch-third__party_libwebrtc_rtc__base_physical__socket__server.cc) = 6909c4da9e7b3785252e5bce9be0ff47ebb87e01
 SHA1 (patch-third__party_libwebrtc_rtc__base_platform__thread__types.cc) = 8ae75100775037347008d168eedc151e0e993b0f
 SHA1 (patch-third__party_python_dlmanager_check.py) = 69054522d8ced8cb47e65e5a8b1a87ed5ce6708e
+SHA1 (patch-third__party_rust_mtu_src_bindings_netbsd.rs) = 235919eb1efc80a153d8236c572c38847354e2e2
 SHA1 (patch-third__party_sqlite3_ext_moz.build) = 026483e9cdc61eda80b699978b1677e1b6d3ff6d
 SHA1 (patch-third__party_sqlite3_src_moz.build) = b26856a4b87aa12211575d9982f62dc899474b52
 SHA1 (patch-third__party_wasm2c_src_c-writer.cc) = 38eb2ee0e00722aa1380540b83648b43723719aa

Index: pkgsrc/www/firefox/mozilla-common.mk
diff -u pkgsrc/www/firefox/mozilla-common.mk:1.315 pkgsrc/www/firefox/mozilla-common.mk:1.316
--- pkgsrc/www/firefox/mozilla-common.mk:1.315  Fri Jun 12 07:28:27 2026
+++ pkgsrc/www/firefox/mozilla-common.mk        Thu Jul 16 13:11:48 2026
@@ -1,4 +1,4 @@
-# $NetBSD: mozilla-common.mk,v 1.315 2026/06/12 07:28:27 wiz Exp $
+# $NetBSD: mozilla-common.mk,v 1.316 2026/07/16 13:11:48 ryoon Exp $
 #
 # common Makefile fragment for mozilla packages based on gecko 2.0.
 #
@@ -42,19 +42,19 @@ TOOL_DEPENDS+=              yasm>=1.1:../../devel/ya
 CFLAGS+=               -msse2
 .endif
 
-#CKSUM_CRATES+=                third_party/rust/quinn-udp
-#
-#CKSUMS+=              b8e595499055115d15bfb95259c0c585934adf55f61e365bcc9fc47ab8fa9cdd
-#CKSUMS+=              7be04be65b1606fd2560d572ba5a6238a645075555085d5e9cef15d10b0b8024
-#
-#SUBST_CLASSES+=       cksum
-#SUBST_STAGE.cksum=    pre-configure
-#.for crate in ${CKSUM_CRATES}
-#SUBST_FILES.cksum+=   ${crate}/.cargo-checksum.json
-#.endfor
-#.for from to in ${CKSUMS}
-#SUBST_SED.cksum+=     -e 's,${from},${to},g'
-#.endfor
+CKSUM_CRATES+=         third_party/rust/mtu
+
+CKSUMS+=               9fbb89ab042627182477b35adc61eed71cffada9d3d5d522766d6d369ad02d80
+CKSUMS+=               497ea06144675260c47a2379c91019c7933bab0c9fa8340021734945556466b9
+
+SUBST_CLASSES+=        cksum
+SUBST_STAGE.cksum=     pre-configure
+.for crate in ${CKSUM_CRATES}
+SUBST_FILES.cksum+=    ${crate}/.cargo-checksum.json
+.endfor
+.for from to in ${CKSUMS}
+SUBST_SED.cksum+=      -e 's,${from},${to},g'
+.endfor
 
 # This is to work around build failures where an upstream configuration script
 # is confused by having more than one approximate match to MACHINE_GNU_PLATFORM
@@ -238,6 +238,9 @@ PLIST.ffvpx=        yes     # see media/ffvpx/ffvpx
 CONFIGURE_ARGS.Darwin+=        --disable-sandbox
 CONFIGURE_ARGS.NetBSD+=        --disable-sandbox
 
+# XXX
+#CONFIGURE_ARGS.NetBSD+=       --disable-memfd_create
+
 # Makefiles sometimes call "rm -f" without more arguments. Kludge around ...
 .PHONY: create-rm-wrapper
 pre-configure: create-rm-wrapper

Index: pkgsrc/www/firefox/files/node-wrapper.sh
diff -u pkgsrc/www/firefox/files/node-wrapper.sh:1.39 pkgsrc/www/firefox/files/node-wrapper.sh:1.40
--- pkgsrc/www/firefox/files/node-wrapper.sh:1.39       Sat May 30 17:06:09 2026
+++ pkgsrc/www/firefox/files/node-wrapper.sh    Thu Jul 16 13:11:48 2026
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-VERS=v26.2.0
+VERS=v26.5.0
 
 if [ "$1" = "-v" ] || [ "$1" = "--version" ]; then
        printf "${VERS}\n"

Index: pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js
diff -u pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.24 pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.25
--- pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.24        Mon Oct 27 14:24:33 2025
+++ pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js     Thu Jul 16 13:11:48 2026
@@ -1,4 +1,4 @@
-$NetBSD: patch-browser_app_profile_firefox.js,v 1.24 2025/10/27 14:24:33 ryoon Exp $
+$NetBSD: patch-browser_app_profile_firefox.js,v 1.25 2026/07/16 13:11:48 ryoon Exp $
 
 This patch modifies default Firefox settings - see the comments above
 each one.
@@ -30,8 +30,8 @@ each one.
 +pref("midi.prompt.testing", true);
 +pref("media.navigator.permission.disabled", true);
 +
-+// Avoid runtime error from WebGL for NetBSD systems
-+pref("webgl.out-of-process", false);
++// Avoid runtime error from WebGL for NetBSD systems. webgl.out-of-process was removed.
++pref("webgl.disabled", true);
 +
 +// Avoid unfunctional video and audio codecs
 +pref("media.allow-audio-non-utility", true);

Index: pkgsrc/www/firefox/patches/patch-python_sites_mach.txt
diff -u pkgsrc/www/firefox/patches/patch-python_sites_mach.txt:1.2 pkgsrc/www/firefox/patches/patch-python_sites_mach.txt:1.3
--- pkgsrc/www/firefox/patches/patch-python_sites_mach.txt:1.2  Sat May 30 17:06:09 2026
+++ pkgsrc/www/firefox/patches/patch-python_sites_mach.txt      Thu Jul 16 13:11:49 2026
@@ -1,18 +1,18 @@
-$NetBSD: patch-python_sites_mach.txt,v 1.2 2026/05/30 17:06:09 ryoon Exp $
+$NetBSD: patch-python_sites_mach.txt,v 1.3 2026/07/16 13:11:49 ryoon Exp $
 
 * We are offline, so do not try to download from pypi.
   No need to wait a timeout.
 * Use pyyaml from vendored unconditionally.
 
---- python/sites/mach.txt.orig 2026-05-13 13:12:50.000000000 +0000
+--- python/sites/mach.txt.orig 2026-06-15 11:44:55.169043237 +0000
 +++ python/sites/mach.txt
 @@ -58,15 +58,16 @@ pth:xpcom/idl-parser
  pth:xpcom/idl-parser
  # glean-sdk may not be installable if a wheel isn't available
  # and it has to be built from source.
--pypi-optional:glean-sdk==67.2.0:telemetry will not be collected
+-pypi-optional:glean-sdk==67.3.2:telemetry will not be collected
 -pypi-optional:orjson>=3.10:json operations will be slower in various tools
-+#pypi-optional:glean-sdk==67.2.0:telemetry will not be collected
++#pypi-optional:glean-sdk==67.3.2:telemetry will not be collected
 +#pypi-optional:orjson>=3.10:json operations will be slower in various tools
  # Mach gracefully handles the case where `psutil` is unavailable.
  # We aren't (yet) able to pin packages in automation, so we have to

Added files:

Index: pkgsrc/www/firefox/patches/patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp
diff -u /dev/null pkgsrc/www/firefox/patches/patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp:1.1
--- /dev/null   Thu Jul 16 13:11:49 2026
+++ pkgsrc/www/firefox/patches/patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp    Thu Jul 16 13:11:49 2026
@@ -0,0 +1,85 @@
+$NetBSD: patch-dom_media_platforms_ffmpeg_FFmpegVulkanVideoDecoder.cpp,v 1.1 2026/07/16 13:11:49 ryoon Exp $
+
+* Fix build under 32-bit platforms.
+
+--- dom/media/platforms/ffmpeg/FFmpegVulkanVideoDecoder.cpp.orig       2026-07-15 02:16:21.002811402 +0000
++++ dom/media/platforms/ffmpeg/FFmpegVulkanVideoDecoder.cpp
+@@ -117,8 +117,8 @@ void FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoD
+   mDeviceFunctions.Clear();
+ 
+   for (int i = 0; i < kNumBuffers; i++) {
+-    mNv12Image[i] = nullptr;
+-    mNv12Mem[i] = nullptr;
++    mNv12Image[i] = VK_NULL_HANDLE;
++    mNv12Mem[i] = VK_NULL_HANDLE;
+     mNv12BaseFd[i] = -1;
+     mCopyDoneSem[i] = VK_NULL_HANDLE;
+     mCopyDoneSemFd[i] = -1;
+@@ -796,11 +796,11 @@ FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoDecode
+     }
+     if (mNv12Image[buf]) {
+       mDestroyImage(mDevice, mNv12Image[buf], nullptr);
+-      mNv12Image[buf] = nullptr;
++      mNv12Image[buf] = VK_NULL_HANDLE;
+     }
+     if (mNv12Mem[buf]) {
+       mFreeMemory(mDevice, mNv12Mem[buf], nullptr);
+-      mNv12Mem[buf] = nullptr;
++      mNv12Mem[buf] = VK_NULL_HANDLE;
+     }
+   }
+ 
+@@ -842,11 +842,11 @@ FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoDecode
+       }
+       if (mNv12Mem[b]) {
+         mFreeMemory(mDevice, mNv12Mem[b], nullptr);
+-        mNv12Mem[b] = nullptr;
++        mNv12Mem[b] = VK_NULL_HANDLE;
+       }
+       if (mNv12Image[b]) {
+         mDestroyImage(mDevice, mNv12Image[b], nullptr);
+-        mNv12Image[b] = nullptr;
++        mNv12Image[b] = VK_NULL_HANDLE;
+       }
+     }
+   });
+@@ -924,7 +924,7 @@ FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoDecode
+     }
+     if (memTypeIndex == UINT32_MAX) {
+       mDestroyImage(mDevice, mNv12Image[buf], nullptr);
+-      mNv12Image[buf] = nullptr;
++      mNv12Image[buf] = VK_NULL_HANDLE;
+       return MediaResult(
+           NS_ERROR_DOM_MEDIA_FATAL_ERR,
+           RESULT_DETAIL("No compatible memory type for NV12 image"));
+@@ -944,7 +944,7 @@ FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoDecode
+     res = mAllocateMemory(mDevice, &allocInfo, nullptr, &mNv12Mem[buf]);
+     if (res != VK_SUCCESS) {
+       mDestroyImage(mDevice, mNv12Image[buf], nullptr);
+-      mNv12Image[buf] = nullptr;
++      mNv12Image[buf] = VK_NULL_HANDLE;
+       return MediaResult(NS_ERROR_DOM_MEDIA_FATAL_ERR,
+                          RESULT_DETAIL("Failed to alloc NV12 memory"));
+     }
+@@ -953,8 +953,8 @@ FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoDecode
+     if (res != VK_SUCCESS) {
+       mFreeMemory(mDevice, mNv12Mem[buf], nullptr);
+       mDestroyImage(mDevice, mNv12Image[buf], nullptr);
+-      mNv12Mem[buf] = nullptr;
+-      mNv12Image[buf] = nullptr;
++      mNv12Mem[buf] = VK_NULL_HANDLE;
++      mNv12Image[buf] = VK_NULL_HANDLE;
+       return MediaResult(NS_ERROR_DOM_MEDIA_FATAL_ERR,
+                          RESULT_DETAIL("Failed to bind NV12 memory"));
+     }
+@@ -981,8 +981,8 @@ FFmpegVideoDecoder<LIBAV_VER>::FFmpegVulkanVideoDecode
+     if (res != VK_SUCCESS) {
+       mFreeMemory(mDevice, mNv12Mem[buf], nullptr);
+       mDestroyImage(mDevice, mNv12Image[buf], nullptr);
+-      mNv12Mem[buf] = nullptr;
+-      mNv12Image[buf] = nullptr;
++      mNv12Mem[buf] = VK_NULL_HANDLE;
++      mNv12Image[buf] = VK_NULL_HANDLE;
+       return MediaResult(NS_ERROR_DOM_MEDIA_FATAL_ERR,
+                          RESULT_DETAIL("Failed to export NV12 FD"));
+     }
Index: pkgsrc/www/firefox/patches/patch-third__party_rust_mtu_src_bindings_netbsd.rs
diff -u /dev/null pkgsrc/www/firefox/patches/patch-third__party_rust_mtu_src_bindings_netbsd.rs:1.1
--- /dev/null   Thu Jul 16 13:11:49 2026
+++ pkgsrc/www/firefox/patches/patch-third__party_rust_mtu_src_bindings_netbsd.rs       Thu Jul 16 13:11:49 2026
@@ -0,0 +1,69 @@
+$NetBSD: patch-third__party_rust_mtu_src_bindings_netbsd.rs,v 1.1 2026/07/16 13:11:49 ryoon Exp $
+
+* Fix build under NetBSD/i386 10.
+
+--- third_party/rust/mtu/src/bindings/netbsd.rs.orig   2026-07-06 16:26:59.000000000 +0000
++++ third_party/rust/mtu/src/bindings/netbsd.rs
+@@ -5,8 +5,8 @@ pub const RTM_GET: u32 = 4;
+ pub const RTA_DST: u32 = 1;
+ pub const RTA_IFP: u32 = 16;
+ pub const RTAX_MAX: u32 = 9;
+-pub type __int32_t = ::std::os::raw::c_int;
+-pub type __int64_t = ::std::os::raw::c_long;
++pub type __int32_t = i32;
++pub type __int64_t = i64;
+ pub type __pid_t = __int32_t;
+ pub type u_char = ::std::os::raw::c_uchar;
+ pub type u_short = ::std::os::raw::c_ushort;
+@@ -19,8 +19,14 @@ pub struct timespec {
+ }
+ #[allow(clippy::unnecessary_operation, clippy::identity_op)]
+ const _: () = {
++    #[cfg(all(target_arch = "x86_64", target_pointer_width = "32"))]
+     ["Size of timespec"][::std::mem::size_of::<timespec>() - 16usize];
++    #[cfg(not(all(target_arch = "x86_64", target_pointer_width = "32")))]
++    ["Size of timespec"][::std::mem::size_of::<timespec>() - 12usize];
++    #[cfg(all(target_arch = "x86_64", target_pointer_width = "32"))]
+     ["Alignment of timespec"][::std::mem::align_of::<timespec>() - 8usize];
++    #[cfg(not(all(target_arch = "x86_64", target_pointer_width = "32")))]
++    ["Alignment of timespec"][::std::mem::align_of::<timespec>() - 4usize];
+     ["Offset of field: timespec::tv_sec"][::std::mem::offset_of!(timespec, tv_sec) - 0usize];
+     ["Offset of field: timespec::tv_nsec"][::std::mem::offset_of!(timespec, tv_nsec) - 8usize];
+ };
+@@ -50,8 +56,14 @@ pub struct if_data {
+ }
+ #[allow(clippy::unnecessary_operation, clippy::identity_op)]
+ const _: () = {
++    #[cfg(all(target_arch = "x86_64", target_pointer_width = "32"))]
+     ["Size of if_data"][::std::mem::size_of::<if_data>() - 136usize];
++    #[cfg(not(all(target_arch = "x86_64", target_pointer_width = "32")))]
++    ["Size of if_data"][::std::mem::size_of::<if_data>() - 132usize];
++    #[cfg(all(target_arch = "x86_64", target_pointer_width = "32"))]
+     ["Alignment of if_data"][::std::mem::align_of::<if_data>() - 8usize];
++    #[cfg(not(all(target_arch = "x86_64", target_pointer_width = "32")))]
++    ["Alignment of if_data"][::std::mem::align_of::<if_data>() - 4usize];
+     ["Offset of field: if_data::ifi_type"][::std::mem::offset_of!(if_data, ifi_type) - 0usize];
+     ["Offset of field: if_data::ifi_addrlen"]
+         [::std::mem::offset_of!(if_data, ifi_addrlen) - 1usize];
+@@ -102,7 +114,10 @@ pub struct rt_metrics {
+ #[allow(clippy::unnecessary_operation, clippy::identity_op)]
+ const _: () = {
+     ["Size of rt_metrics"][::std::mem::size_of::<rt_metrics>() - 80usize];
++    #[cfg(all(target_arch = "x86_64", target_pointer_width = "32"))]
+     ["Alignment of rt_metrics"][::std::mem::align_of::<rt_metrics>() - 8usize];
++    #[cfg(not(all(target_arch = "x86_64", target_pointer_width = "32")))]
++    ["Alignment of rt_metrics"][::std::mem::align_of::<rt_metrics>() - 4usize];
+     ["Offset of field: rt_metrics::rmx_locks"]
+         [::std::mem::offset_of!(rt_metrics, rmx_locks) - 0usize];
+     ["Offset of field: rt_metrics::rmx_mtu"][::std::mem::offset_of!(rt_metrics, rmx_mtu) - 8usize];
+@@ -143,7 +158,10 @@ pub struct rt_msghdr {
+ #[allow(clippy::unnecessary_operation, clippy::identity_op)]
+ const _: () = {
+     ["Size of rt_msghdr"][::std::mem::size_of::<rt_msghdr>() - 120usize];
++    #[cfg(all(target_arch = "x86_64", target_pointer_width = "32"))]
+     ["Alignment of rt_msghdr"][::std::mem::align_of::<rt_msghdr>() - 8usize];
++    #[cfg(not(all(target_arch = "x86_64", target_pointer_width = "32")))]
++    ["Alignment of rt_msghdr"][::std::mem::align_of::<rt_msghdr>() - 4usize];
+     ["Offset of field: rt_msghdr::rtm_msglen"]
+         [::std::mem::offset_of!(rt_msghdr, rtm_msglen) - 0usize];
+     ["Offset of field: rt_msghdr::rtm_version"]