CVS commit: pkgsrc/www/firefox

["Ryo ONODERA" <ryoon%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Tue Nov  3 16:46:29 UTC 2026

Modified Files:
        pkgsrc/www/firefox: Makefile distinfo mozilla-common.mk
        pkgsrc/www/firefox/patches: patch-browser_app_profile_firefox.js
            patch-config_gcc-stl-wrapper.template.h
            patch-config_makefiles_rust.mk patch-python_sites_mach.txt
            patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build

Log Message:
www/firefox: Update to 159.0.1

Changelog:
159.0.1:
Fixed

  * Fixed the dot that marks a tab needing attention being hard to see with
    some themes, depending on the system accent color. (Bug 2086347)

  * Fixed a command prompt window briefly appearing on Windows when Firefox
    restarts to apply an update. (Bug 2081809)

  * Fixed passkey sign-in failing on websites that share passkeys across
    related sites, such as Facebook and Instagram. (Bug 2085450)

  * Fixed crashes on Windows that could occur with some antivirus or other
    security software installed, in some cases also leaving WebGL disabled. (
    Bug 2083648)

  * Fixed red and blue colors appearing swapped on some websites that use WebGL
    on Linux, including video call background effects. (Bug 2087301)

  * Updated time zone data to reflect Cuba's decision not to end daylight
    saving time on November 1, 2026. (Bug 2086609)

  * Fixed text in some Settings descriptions, such as security warnings,
    breaking in the middle of words. (Bug 2086282)

  * Security fix.

Security fixes:
Mozilla Foundation Security Advisory 2026-123
#CVE-2026-120572: Incorrect boundary conditions in the Layout: Block and Inline
 component

159.0:
New

  * Sharing on macOS now uses the native macOS share picker, which shows a
    preview of the page and recent contacts alongside AirDrop, Messages, and
    other apps. Several selected tabs can also be shared at once.

  * Saved passwords are now available from the sidebar by default, without
    having to add the Passwords tool first.

  * Smart Window can now watch pages for changes such as price drops or
    restocks. Type /watch in the chat to set one up, and Firefox sends a
    desktop notification when it finds a match. Watches can be managed from the
    Tasks button in the toolbar or the about:smartwindowtasks page.

Fixed

  * Fixed the file upload dialog opening in the last folder a file was saved
    to, such as Downloads, instead of the folder last used for uploads.

  * Fixed memory usage growing rapidly when sites such as the Zoom web app were
    left open in a minimized window.

  * Fixed some videos displaying incorrectly on Windows when NVIDIA RTX Video
    HDR is enabled.

  * Fixed bookmarks not being imported from Google Chrome profiles that are
    signed in to a Google account.

  * Fixed the Replace button in Apple Writing Tools on macOS inserting the
    clipboard contents instead of the rewritten text on some sites, such as
    Gmail.

  * Fixed long drop-down lists on web pages sometimes showing blank space in
    place of the last options until the list was scrolled.

  * Fixed some sites, such as Slack, failing to load instead of falling back to
    HTTP/2 when the site rejected an HTTP/3 request.

  * Fixed Firefox using excessive memory on Linux with AMD graphics when
    viewing map or place results on sites such as ChatGPT.

  * Fixed quick gamepad button presses sometimes being missed in web games on
    macOS.

  * Fixed tabs sometimes detaching into a new window when clicked on Linux with
    Wayland.

  * Fixed menus and panels fading in on Windows and Linux when animation
    effects are turned off in the operating system.

  * Various security fixes.

Security fixes:
Mozilla Foundation Security Advisory 2026-118
#CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component
#CVE-2026-117861: Sandbox escape in the DOM: Navigation component
#CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in
the Networking component
#CVE-2026-117863: Information disclosure due to uninitialized memory in the
Audio/Video component
#CVE-2026-117864: Sandbox escape in the Form Manager component
#CVE-2026-117865: Use-after-free in the JavaScript: GC component
#CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
#CVE-2026-117867: Use-after-free in the Layout component
#CVE-2026-117868: Sandbox escape in the DOM: Networking component
#CVE-2026-117869: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117870: Use-after-free in the JavaScript Engine component
#CVE-2026-117871: Invalid pointer in the Graphics component
#CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component
#CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback
component
#CVE-2026-118005: Use-after-free in the WebRTC: Signaling component
#CVE-2026-117874: Use-after-free in the Internationalization component
#CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow
component
#CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-118006: Privilege escalation due to use-after-free in the WebRTC:
Signaling component
#CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-118007: Use-after-free in the JavaScript: GC component
#CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB
component
#CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component
#CVE-2026-118008: Privilege escalation in the DOM: Navigation component
#CVE-2026-117880: Use-after-free in the XML component
#CVE-2026-118009: Integer overflow, use-after-free in the Graphics: Text
component
#CVE-2026-117881: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117882: Use-after-free in the Layout component
#CVE-2026-117883: Use-after-free in the DOM: HTML Parser component
#CVE-2026-117884: Use-after-free in the Networking component
#CVE-2026-117885: Use-after-free in the Layout: Grid component
#CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component
#CVE-2026-117887: Use-after-free in the DOM: Core & HTML component
#CVE-2026-118010: Use-after-free in the Disability Access APIs component
#CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component
#CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine
component
#CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component
#CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC:
Networking component
#CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component
#CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling
component
#CVE-2026-117895: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117896: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component
#CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-117899: Use-after-free in the Networking: HTTP component
#CVE-2026-117900: Use-after-free in the DOM: Editor component
#CVE-2026-117901: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-117903: Use-after-free in the Audio/Video component
#CVE-2026-117904: Use-after-free in the JavaScript: GC component
#CVE-2026-117905: Use-after-free in the Audio/Video: Playback component
#CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component
#CVE-2026-117907: Use-after-free in the Networking component
#CVE-2026-117908: Use-after-free in the Graphics: ImageLib component
#CVE-2026-117909: Use-after-free in the JavaScript: GC component
#CVE-2026-117910: Invalid pointer in the JavaScript Engine component
#CVE-2026-117911: Use-after-free in the Audio/Video: Playback component
#CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation
#CVE-2026-117913: Use-after-free in the SVG component
#CVE-2026-117914: Use-after-free in the SVG component
#CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline
component
#CVE-2026-117916: Use-after-free in the XSLT component
#CVE-2026-117917: Invalid pointer in the Graphics: WebRender component
#CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-117919: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117920: Use-after-free in the DOM: HTML Parser component
#CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component
#CVE-2026-117922: Use-after-free in the Networking: WebSockets component
#CVE-2026-117923: Use-after-free in the Audio/Video component
#CVE-2026-117924: Use-after-free in the XSLT component
#CVE-2026-117925: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117926: Incorrect boundary conditions in the SVG component
#CVE-2026-117927: Use-after-free in the SVG component
#CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation
component
#CVE-2026-117929: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component
#CVE-2026-117931: Use-after-free in the DOM: Events component
#CVE-2026-117932: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component
#CVE-2026-117934: Use-after-free in the Layout component
#CVE-2026-118011: Frame poisoning in the CSS Parsing and Computation component
#CVE-2026-118012: Use-after-free in the DOM: Animation component
#CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component
#CVE-2026-117936: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117937: Invalid pointer in the JavaScript Engine component
#CVE-2026-117938: Use-after-free in the Layout component
#CVE-2026-117939: Use-after-free in the XML component
#CVE-2026-117940: Use-after-free in the DOM: Core & HTML component
#CVE-2026-118013: Use-after-free in the Layout: Images, Video, and HTML Frames
component
#CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component
#CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT
component
#CVE-2026-118014: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-117943: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117944: Use-after-free in the Layout component
#CVE-2026-118015: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117945: Incorrect boundary conditions in the XML component
#CVE-2026-118016: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine
component
#CVE-2026-117947: Use-after-free in the XML component
#CVE-2026-117948: Use-after-free in the SVG component
#CVE-2026-117949: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML
component
#CVE-2026-117951: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117952: Uninitialized memory in the Networking component
#CVE-2026-117953: Use-after-free in the DOM: Core & HTML component
#CVE-2026-118017: Use-after-free in the SVG component
#CVE-2026-117954: Use-after-free in the Layout: Positioned component
#CVE-2026-118018: Spoofing issue in the Downloads component in Firefox for
Android
#CVE-2026-118019: Race condition, use-after-free in the DOM: File component
#CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-100801: Privilege escalation in the DLL Services component
#CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component
#CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component
#CVE-2026-117958: Site isolation issue in the Networking: HTTP component
#CVE-2026-117959: Site isolation issue in the DOM: Service Workers component
#CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component
#CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts
component
#CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the
Storage: Quota Manager component
#CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers
component
#CVE-2026-117964: Use-after-free in the Panning and Zooming component
#CVE-2026-117965: Same-origin policy bypass in the Address Bar component
#CVE-2026-117966: Site isolation issue in the Networking: HTTP component
#CVE-2026-117967: Mitigation bypass in the DOM: Security component
#CVE-2026-118020: Use-after-free in the Layout component
#CVE-2026-117968: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component
#CVE-2026-117970: Race condition in the Disability Access APIs component
#CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview
component
#CVE-2026-117972: Use-after-free in the Graphics component
#CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component
#CVE-2026-117973: Use-after-free in the Networking: DNS component
#CVE-2026-117974: Use-after-free in the XML component
#CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics:
WebRender component
#CVE-2026-117976: Site isolation issue in the DOM: Navigation component
#CVE-2026-117977: Other issue in the Console component
#CVE-2026-117978: Incorrect boundary conditions in the Graphics component
#CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender
component
#CVE-2026-117980: Use-after-free in the Graphics component
#CVE-2026-117981: Privilege escalation in the Toolkit component
#CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component
#CVE-2026-117983: Use-after-free in the Graphics component
#CVE-2026-118022: Sandbox escape due to use-after-free in the Disability Access
APIs component
#CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and
Overflow component
#CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics
component
#CVE-2026-117986: Use-after-free in the Graphics component
#CVE-2026-117987: Use-after-free in the Graphics component
#CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component
#CVE-2026-117989: Use-after-free in the Graphics component
#CVE-2026-118023: Sandbox escape due to use-after-free in the Graphics:
WebRender component
#CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
#CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts
component
#CVE-2026-117992: Information disclosure in the CSS Parsing and Computation
component
#CVE-2026-117993: Integer overflow in the Graphics: Text component
#CVE-2026-117994: Use-after-free in the JavaScript: GC component
#CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling
component
#CVE-2026-117996: Incorrect boundary conditions in the WebRTC component
#CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component
#CVE-2026-118024: Use-after-free in the Graphics: Text component
#CVE-2026-118025: Other issue in the SVG component
#CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component
#CVE-2026-117999: Race condition in the IPC component
#CVE-2026-118000: Information disclosure in the Networking: HTTP component
#CVE-2026-118002: Information disclosure due to race condition in the
Networking component
#CVE-2026-118003: Information disclosure in the Networking: DNS component
#CVE-2026-118026: Invalid pointer in the JavaScript: GC component
#CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and
Animations component


To generate a diff of this commit:
cvs rdiff -u -r1.679 -r1.680 pkgsrc/www/firefox/Makefile
cvs rdiff -u -r1.597 -r1.598 pkgsrc/www/firefox/distinfo
cvs rdiff -u -r1.326 -r1.327 pkgsrc/www/firefox/mozilla-common.mk
cvs rdiff -u -r1.28 -r1.29 \
    pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js
cvs rdiff -u -r1.7 -r1.8 \
    pkgsrc/www/firefox/patches/patch-config_gcc-stl-wrapper.template.h
cvs rdiff -u -r1.17 -r1.18 \
    pkgsrc/www/firefox/patches/patch-config_makefiles_rust.mk
cvs rdiff -u -r1.5 -r1.6 \
    pkgsrc/www/firefox/patches/patch-python_sites_mach.txt
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox/Makefile
diff -u pkgsrc/www/firefox/Makefile:1.679 pkgsrc/www/firefox/Makefile:1.680
--- pkgsrc/www/firefox/Makefile:1.679   Fri Oct 16 16:28:47 2026
+++ pkgsrc/www/firefox/Makefile Tue Nov  3 16:46:29 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.679 2026/10/16 16:28:47 ryoon Exp $
+# $NetBSD: Makefile,v 1.680 2026/11/03 16:46:29 ryoon Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            158.0
-MOZ_BRANCH_MINOR=      
+MOZ_BRANCH=            159.0
+MOZ_BRANCH_MINOR=      .1
 CANDIDATE_BUILD=       # for release, make this empty
 
 DISTNAME=      firefox-${FIREFOX_VER}.source

Index: pkgsrc/www/firefox/distinfo
diff -u pkgsrc/www/firefox/distinfo:1.597 pkgsrc/www/firefox/distinfo:1.598
--- pkgsrc/www/firefox/distinfo:1.597   Fri Oct 16 16:28:47 2026
+++ pkgsrc/www/firefox/distinfo Tue Nov  3 16:46:29 2026
@@ -1,17 +1,17 @@
-$NetBSD: distinfo,v 1.597 2026/10/16 16:28:47 ryoon Exp $
+$NetBSD: distinfo,v 1.598 2026/11/03 16:46:29 ryoon Exp $
 
-BLAKE2s (firefox-158.0.source.tar.xz) = 03c9e9731e2f0a1cf4d77a0a2ff8af2c0ac1e383e80f110c8cbd5f76355bbb5f
-SHA512 (firefox-158.0.source.tar.xz) = 14b8ffdc325a234061db14dea9bd144786dc2c84468a5dfe2bb70bb9558f63f73427cf244eaf461010ee01dfdf04f2cae68bae9f07b4820603a4bcd4462f7960
-Size (firefox-158.0.source.tar.xz) = 814889676 bytes
+BLAKE2s (firefox-159.0.1.source.tar.xz) = f720bec1d79e3d1e406faa90dbfdf1bb5902908aacabd2fdd26a911ab86b2d55
+SHA512 (firefox-159.0.1.source.tar.xz) = e7375c0c18361b22fa1d2e6fd5f6a4ff20b22e7090a64bf32d7ef79edb0a649983439b8e6e80106fe51bb96699bdd3096c921fe198d1b460193a66d6d8f227a4
+Size (firefox-159.0.1.source.tar.xz) = 817946068 bytes
 BLAKE2s (nodejs-output-156.0.1.tgz) = 26aa0e33c007e8c08ebbe87dd1004c0cee01d9bed8a3b96ed5ccdc4062324e8d
 SHA512 (nodejs-output-156.0.1.tgz) = 6b6bc87f4dacc2f77bb525aa484ac7cb5035502033dc37f8b46d047659a516631281e332515ca450cd5cce4d01d7102d7fc011771a9bc0ea15633b233a0ffe31
 Size (nodejs-output-156.0.1.tgz) = 251380 bytes
-SHA1 (patch-browser_app_profile_firefox.js) = 1fe46a0bb3d29520d19755a8786457b3259a6c96
+SHA1 (patch-browser_app_profile_firefox.js) = 1168ba368c5ffdcf77e330366848466f48a92642
 SHA1 (patch-build_gn__processor.py) = c9b2f31787704c3fec466711010ef632199ae385
 SHA1 (patch-build_moz.configure_init.configure) = 65deb3c233df0aab81eb1fca05d708e5a4ed169a
 SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
-SHA1 (patch-config_gcc-stl-wrapper.template.h) = b5b4f2aef747836b09584b77d6332a7010963b0b
-SHA1 (patch-config_makefiles_rust.mk) = 74c18ac9c37ff268428961275df3e77a7b1ed537
+SHA1 (patch-config_gcc-stl-wrapper.template.h) = 9360a859e71ebfbead97c0bfbb5153cb2184381a
+SHA1 (patch-config_makefiles_rust.mk) = 2e1c6093090b5d49700f381ad7f2d64bc9931ea4
 SHA1 (patch-config_system-headers.mozbuild) = 227a2a8c3ed38b4599895069e2c599881ec723b8
 SHA1 (patch-dom_base_nsAttrName.h) = ac7ba441a3b27df2855cf2673eea36b1cb44ad49
 SHA1 (patch-dom_canvas_WebGLMethodDispatcher.h) = 78f6e44116a939615523339fb73ac93f40777749
@@ -44,7 +44,7 @@ SHA1 (patch-netwerk_protocol_http_nsHttp
 SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = c99c3ce679f4196fc3baaf65051471a13d6fe8cd
 SHA1 (patch-python_mozbuild_mozbuild_backend_recursivemake.py) = 5be4183d9075f5a3a3c6b3e0338473af185fb50e
 SHA1 (patch-python_sites_build.txt) = 2f716b67b47d8d0f648f466aabdc1c4e90d0f024
-SHA1 (patch-python_sites_mach.txt) = be4acab3eb38a12aad95209a539fc5dde8982f38
+SHA1 (patch-python_sites_mach.txt) = 27a23ac588941467b5849bcc42ba4a1c8435eafd
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_elf__mem__image.cc) = b1067a6804470f7e365f347683b7d505853fd799
 SHA1 (patch-third__party_abseil-cpp_absl_debugging_internal_vdso__support.cc) = f9c44d0d6fd952296f23c24f56053958b30d8e5c
 SHA1 (patch-third__party_angle_angle__common__gn_moz.build) = 836c33a87239f69c9bcf0efedcdfef2094de1467
@@ -55,7 +55,7 @@ SHA1 (patch-third__party_js_cfworker_bui
 SHA1 (patch-third__party_libwebrtc_modules_audio__device_audio__device__impl.cc) = 127284a1a9b6e12581d325f5a5aadae443b0e57b
 SHA1 (patch-third__party_libwebrtc_modules_desktop__capture_desktop__capture__gn_moz.build) = da85f4a3e22c4a346f1f8e87ecdc62bf8c0bddd7
 SHA1 (patch-third__party_libwebrtc_modules_desktop__capture_linux_wayland_egl__dmabuf.cc) = 89f8f8eb5dcb877e0c70120f742050f1b32676fb
-SHA1 (patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build) = 87fe72745f7a01596b8be70d618491387e1aaa36
+SHA1 (patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build) = 478607ffb009ad5ca5664936c108fb97814a2317
 SHA1 (patch-third__party_libwebrtc_modules_video__capture_linux_device__info__v4l2.cc) = a4b04c390f93ffbc79e049f532251bfa00376eff
 SHA1 (patch-third__party_libwebrtc_modules_video__capture_linux_video__capture__v4l2.cc) = 9f1e606242b2ab2625dabc06f25b593f4721d387
 SHA1 (patch-third__party_libwebrtc_modules_video__capture_video__capture__internal__impl__gn_moz.build) = 2a214979769cbf57b1d534610e524138aac7fc2b

Index: pkgsrc/www/firefox/mozilla-common.mk
diff -u pkgsrc/www/firefox/mozilla-common.mk:1.326 pkgsrc/www/firefox/mozilla-common.mk:1.327
--- pkgsrc/www/firefox/mozilla-common.mk:1.326  Wed Sep 23 08:39:50 2026
+++ pkgsrc/www/firefox/mozilla-common.mk        Tue Nov  3 16:46:29 2026
@@ -1,4 +1,4 @@
-# $NetBSD: mozilla-common.mk,v 1.326 2026/09/23 08:39:50 ryoon Exp $
+# $NetBSD: mozilla-common.mk,v 1.327 2026/11/03 16:46:29 ryoon Exp $
 #
 # common Makefile fragment for mozilla packages based on gecko 2.0.
 #
@@ -44,8 +44,8 @@ CFLAGS+=              -msse2
 
 CKSUM_CRATES+=         third_party/rust/mtu
 
-CKSUMS+=               9fbb89ab042627182477b35adc61eed71cffada9d3d5d522766d6d369ad02d80
-CKSUMS+=               986f84f01a44521224c7a7c1b1883cc6a4f89cbcb24b36844bfffea5f285747e
+CKSUMS+=               ffc9689baca349ecae41251c6e98a1947e9bad232b167caa1ba586dfef5fa457
+CKSUMS+=               7e4c1ad17090e25376316d116b0b10fd938272dae0bd50befca61895a585a895
 
 SUBST_CLASSES+=                cksum
 SUBST_STAGE.cksum=     pre-configure

Index: pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js
diff -u pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.28 pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.29
--- pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js:1.28        Fri Oct 16 16:28:47 2026
+++ pkgsrc/www/firefox/patches/patch-browser_app_profile_firefox.js     Tue Nov  3 16:46:29 2026
@@ -1,13 +1,13 @@
-$NetBSD: patch-browser_app_profile_firefox.js,v 1.28 2026/10/16 16:28:47 ryoon Exp $
+$NetBSD: patch-browser_app_profile_firefox.js,v 1.29 2026/11/03 16:46:29 ryoon Exp $
 
 This patch modifies default Firefox settings - see the comments above
 each one.
 
---- browser/app/profile/firefox.js.orig        2026-09-24 10:45:34.000000000 +0000
+--- browser/app/profile/firefox.js.orig        2026-10-22 17:49:06.000000000 +0000
 +++ browser/app/profile/firefox.js
-@@ -3055,6 +3055,36 @@ pref("toolkit.coverage.endpoint.base", "https://covera
- pref("toolkit.coverage.enabled", false);
- pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org";);
+@@ -3129,6 +3129,36 @@ pref("app.normandy.onsync_skew_sec", 600);
+   pref("intl.multilingual.aboutWelcome.languageMismatchEnabled", false);
+ #endif
  
 +// Select UI locale from LANG/LC_MESSAGE environmental variables
 +pref("intl.locale.requested", "");

Index: pkgsrc/www/firefox/patches/patch-config_gcc-stl-wrapper.template.h
diff -u pkgsrc/www/firefox/patches/patch-config_gcc-stl-wrapper.template.h:1.7 pkgsrc/www/firefox/patches/patch-config_gcc-stl-wrapper.template.h:1.8
--- pkgsrc/www/firefox/patches/patch-config_gcc-stl-wrapper.template.h:1.7      Mon Aug 24 12:51:47 2026
+++ pkgsrc/www/firefox/patches/patch-config_gcc-stl-wrapper.template.h  Tue Nov  3 16:46:29 2026
@@ -1,6 +1,6 @@
-$NetBSD: patch-config_gcc-stl-wrapper.template.h,v 1.7 2026/08/24 12:51:47 ryoon Exp $
+$NetBSD: patch-config_gcc-stl-wrapper.template.h,v 1.8 2026/11/03 16:46:29 ryoon Exp $
 
---- config/gcc-stl-wrapper.template.h.orig     2026-04-15 13:12:19.000000000 +0000
+--- config/gcc-stl-wrapper.template.h.orig     2026-10-22 17:49:07.000000000 +0000
 +++ config/gcc-stl-wrapper.template.h
 @@ -27,8 +27,8 @@
  // limits) and bug 1694575 (iosfwd).
@@ -13,15 +13,6 @@ $NetBSD: patch-config_gcc-stl-wrapper.te
  #endif
  
  #ifndef moz_dont_include_mozalloc_for_cmath
-@@ -50,7 +50,7 @@
- // Include mozalloc after the STL header and all other headers it includes
- // have been preprocessed.
- #if !defined(MOZ_INCLUDE_MOZALLOC_H) && \
--    !defined(moz_dont_include_mozalloc_for_${HEADER})
-+    !defined(moz_dont_include_mozalloc_for_${HEADER})
- #  define MOZ_INCLUDE_MOZALLOC_H
- #  define MOZ_INCLUDE_MOZALLOC_H_FROM_${HEADER}
- #endif
 @@ -78,5 +78,7 @@
  #ifndef mozilla_throw_gcc_h
  #  include "mozilla/throw_gcc.h"

Index: pkgsrc/www/firefox/patches/patch-config_makefiles_rust.mk
diff -u pkgsrc/www/firefox/patches/patch-config_makefiles_rust.mk:1.17 pkgsrc/www/firefox/patches/patch-config_makefiles_rust.mk:1.18
--- pkgsrc/www/firefox/patches/patch-config_makefiles_rust.mk:1.17      Fri Oct 16 16:28:47 2026
+++ pkgsrc/www/firefox/patches/patch-config_makefiles_rust.mk   Tue Nov  3 16:46:29 2026
@@ -1,4 +1,4 @@
-$NetBSD: patch-config_makefiles_rust.mk,v 1.17 2026/10/16 16:28:47 ryoon Exp $
+$NetBSD: patch-config_makefiles_rust.mk,v 1.18 2026/11/03 16:46:29 ryoon Exp $
 
 NetBSD doesn't get along with parallel rust builds (it causes issues
 with ld.so) which are the default. Force -j1.
@@ -6,25 +6,15 @@ with ld.so) which are the default. Force
 Use less memory to fix build under NetBSD/i386.
 From: https://bugzilla.mozilla.org/show_bug.cgi?id=1644409
 
---- config/makefiles/rust.mk.orig      2026-10-08 02:23:59.000000000 +0000
+--- config/makefiles/rust.mk.orig      2026-10-22 17:49:06.000000000 +0000
 +++ config/makefiles/rust.mk
-@@ -45,6 +45,9 @@ endif
- endif
- endif
+@@ -15,6 +15,9 @@ endif
+ else
+ normalize_sep = $(1)
  endif
 +ifeq ($(OS_ARCH),NetBSD)
 +cargo_build_flags += @RUST_MAKE_JOBS@
 +endif
  
- # Without -j > 1, make will not pass jobserver info down to cargo. Force
- # one job when requested as a special case.
-@@ -56,7 +59,8 @@ ifdef RUST_LIBRARY_LTO
- cargo_rustc_flags = $(CARGO_RUSTCFLAGS)
- # Enable link-time optimization for release builds.
- ifdef RUST_LIBRARY_LTO
--cargo_rustc_flags += -Clto
-+cargo_rustc_flags += -Clto=thin
-+export CARGO_PROFILE_RELEASE_LTO=thin
- endif
- 
- ifdef CARGO_INCREMENTAL
+ # The + prefix preserves jobserver file descriptors. Omit it for `make -n`.
+ # Pass --single-job when Make is limited to one job.

Index: pkgsrc/www/firefox/patches/patch-python_sites_mach.txt
diff -u pkgsrc/www/firefox/patches/patch-python_sites_mach.txt:1.5 pkgsrc/www/firefox/patches/patch-python_sites_mach.txt:1.6
--- pkgsrc/www/firefox/patches/patch-python_sites_mach.txt:1.5  Fri Oct 16 16:28:47 2026
+++ pkgsrc/www/firefox/patches/patch-python_sites_mach.txt      Tue Nov  3 16:46:29 2026
@@ -1,18 +1,18 @@
-$NetBSD: patch-python_sites_mach.txt,v 1.5 2026/10/16 16:28:47 ryoon Exp $
+$NetBSD: patch-python_sites_mach.txt,v 1.6 2026/11/03 16:46:29 ryoon Exp $
 
 * We are offline, so do not try to download from pypi.
   No need to wait a timeout.
 * Use pyyaml from vendored unconditionally.
 
---- python/sites/mach.txt.orig 2026-10-08 02:24:09.000000000 +0000
+--- python/sites/mach.txt.orig 2026-10-22 17:49:16.000000000 +0000
 +++ python/sites/mach.txt
 @@ -58,15 +58,16 @@ pth:xpcom/idl-parser
  pth:xpcom/idl-parser
  # glean-sdk may not be installable if a wheel isn't available
  # and it has to be built from source.
--pypi-optional:glean-sdk==70.2.0:telemetry will not be collected
+-pypi-optional:glean-sdk==70.2.1:telemetry will not be collected
 -pypi-optional:orjson>=3.10:json operations will be slower in various tools
-+#pypi-optional:glean-sdk==70.2.0:telemetry will not be collected
++#pypi-optional:glean-sdk==70.2.1:telemetry will not be collected
 +#pypi-optional:orjson>=3.10:json operations will be slower in various tools
  # Mach gracefully handles the case where `psutil` is unavailable.
  # We aren't (yet) able to pin packages in automation, so we have to

Index: pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build
diff -u pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build:1.2 pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build:1.3
--- pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build:1.2     Mon Jan 19 12:06:04 2026
+++ pkgsrc/www/firefox/patches/patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build Tue Nov  3 16:46:29 2026
@@ -1,18 +1,18 @@
-$NetBSD: patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build,v 1.2 2026/01/19 12:06:04 ryoon Exp $
+$NetBSD: patch-third__party_libwebrtc_modules_portal_portal__gn_moz.build,v 1.3 2026/11/03 16:46:29 ryoon Exp $
 
---- third_party/libwebrtc/modules/portal/portal_gn/moz.build.orig      2026-01-02 07:16:24.028920365 +0000
+--- third_party/libwebrtc/modules/portal/portal_gn/moz.build.orig      2026-10-27 07:57:59.150870854 +0000
 +++ third_party/libwebrtc/modules/portal/portal_gn/moz.build
-@@ -38,7 +38,8 @@ DEFINES["WEBRTC_MOZILLA_BUILD"] = True
+@@ -39,7 +39,8 @@ DEFINES["WEBRTC_STRICT_FIELD_TRIALS"] = "0"
  DEFINES["WEBRTC_NON_STATIC_TRACE_EVENT_HANDLERS"] = "0"
  DEFINES["WEBRTC_POSIX"] = True
  DEFINES["WEBRTC_STRICT_FIELD_TRIALS"] = "0"
 -DEFINES["WEBRTC_USE_PIPEWIRE"] = True
 +if CONFIG["OS_TARGET"] == "Linux":
 +    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
+ DEFINES["WEBRTC_WITHOUT_RUST"] = True
  DEFINES["_FILE_OFFSET_BITS"] = "64"
  DEFINES["_GNU_SOURCE"] = True
- DEFINES["_LARGEFILE64_SOURCE"] = True
-@@ -62,10 +63,13 @@ LOCAL_INCLUDES += [
+@@ -64,10 +65,13 @@ UNIFIED_SOURCES += [
  ]
  
  UNIFIED_SOURCES += [