MX 17/18 Repository: The Pale Moon Browser Thread

[Stevo]

Updated to 28.10.0 in the main repo!

This is a development, bugfix and security update.

Changes/fixes:

Implemented URLSearchParams' sort() function
Implemented ES2020 globalThis for web compatibility
Improved our WebM media parser to be more tolerant to different encoding styles.
Improved our MP3 media parser to be more tolerant to different encoding styles and particularly tiny files/stream chunks.
Improved performance of table drawing for more corner cases
Changed the way images without a src are handled in page layouts to align with the Chrome-pushed spec.
Added modern MIPS support
Split out the ICU data file from xul.dll on Windows
Fixed a regression in WebAudio channel handling due to a landed security fix.
Fixed a regression preventing scripting from properly disabling input controls
Fixed an issue with border radius sometimes not being honored in tables
Fixed some build issues in non-standard configurations.
Removed more telemetry code
Removed the in-browser speech recognition engine and API
Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
Changed handling of braille blanks in the ui (CVE-2020-12409) DiD
Mitigated a potential timing attack against DSA keys in NSS (CVE-2020-12399)

[dreamer]

Thank you! Sometimes I have to use Firefox or Chrome, but I hope Pale Moon can stay relevant on a chromified Web.

[app4soft]

Updated to 28.10.0 in the main repo!

Pale Moon 28.11.0 released yesterday:

This is a development, bugfix and security update.

Changes/fixes:

Changed storage format for certificates and passwords to SQLite.
Added a preference (browser.tabs.insertAllAfterCurrent) to enable always adding new tabs after the current tab, whether related or not.
Changed the way Firefox extensions are displayed in the add-on manager (provide a clear warning).
Denied other types of add-ons that aren't explicitly targeting Pale Moon's ID.
Improved the browser's DPI-awareness to be per-monitor instead of system-wide, on supported Windows operating systems.
Updated bookmark backups code with the other half of what should have been done way back when, so they work fully as-intended.
Added a preference (browser.bookmarks.editDialog.showForNewBookmarks) to enable immediately showing the edit dialog for new bookmarks.
If set to true, clicking the star in the address bar will pop open the edit dialog immediately for changing details/sorting.
Fixed the useragent string in native mode, and updated UA code to properly respond to live changes to some preferences.
Tidied up front-end browser JavaScript.
Changed the way sources are compiled (on-going de-unification).
Improved compatibility with gcc v10
Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
Fixed some build issues in non-standard configurations.
Fixed wrong positions when calculating the position for position:absolute child inside a table.
Aligned file name extension of saved url files with other applications (lower case)
Fixed building with --disable-webspeech (to disable speech synthesis)
Added global menubar support for GTK.
Implemented node.getRootNode
Implemented AbortController (Abort API)
Improved the uninstaller to use elevation when prudent and actually remove program files.
Fixed a rare issue with editable page content.
Fixed a crash related to ES module scripts.
Aligned ES module scripting better with the current spec and removed eager instantiation.
Fixed a potential issue with the JPEG encoder. (CVE-2020-12422) DiD
Fixed a potential issue with AppCache manifests. DiD
Fixed a potential crash in JavaScript date parsing.
Fixed a problem with RSA key generation that would make it potentially vulnerable to side-channel attacks. (CVE-2020-12402)
Fixed a potential crash due to multithread race condition. DiD
Fixed a correctness issue in URL handling. (CVE-2020-12418) DiD

[Stevo]

Updated to 28.11.0 in the main repo:

Changed storage format for certificates and passwords to SQLite.
Added a preference (browser.tabs.insertAllAfterCurrent) to enable always adding new tabs after the current tab, whether related or not.
Changed the way Firefox extensions are displayed in the add-on manager (provide a clear warning).
Denied other types of add-ons that aren't explicitly targeting Pale Moon's ID.
Improved the browser's DPI-awareness to be per-monitor instead of system-wide, on supported Windows operating systems.
Updated bookmark backups code with the other half of what should have been done way back when, so they work fully as-intended.
Added a preference (browser.bookmarks.editDialog.showForNewBookmarks) to enable immediately showing the edit dialog for new bookmarks.
If set to true, clicking the star in the address bar will pop open the edit dialog immediately for changing details/sorting.
Fixed the useragent string in native mode, and updated UA code to properly respond to live changes to some preferences.
Tidied up front-end browser JavaScript.
Changed the way sources are compiled (on-going de-unification).
Improved compatibility with gcc v10
Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
Fixed some build issues in non-standard configurations.
Fixed wrong positions when calculating the position for position:absolute child inside a table.
Aligned file name extension of saved url files with other applications (lower case)
Fixed building with --disable-webspeech (to disable speech synthesis)
Added global menubar support for GTK.
Implemented node.getRootNode
Implemented AbortController (Abort API)
Improved the uninstaller to use elevation when prudent and actually remove program files.
Fixed a rare issue with editable page content.
Fixed a crash related to ES module scripts.
Aligned ES module scripting better with the current spec and removed eager instantiation.
Fixed a potential issue with the JPEG encoder. (CVE-2020-12422) DiD
Fixed a potential issue with AppCache manifests. DiD
Fixed a potential crash in JavaScript date parsing.
Fixed a problem with RSA key generation that would make it potentially vulnerable to side-channel attacks. (CVE-2020-12402)
Fixed a potential crash due to multithread race condition. DiD
Fixed a correctness issue in URL handling. (CVE-2020-12418) DiD
Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 4 defense-in-depth, 10 not applicable.

[Stevo]

Updated to 28.12.0 in the main repo!

v28.12.0 (2020-08-04)
This is a development, bugfix and security update.

Changes/fixes:

Added controls for WASM to the browser's preferences, and enabled by default.
Enabled various arbitrarily-disabled CSS functions.
Added the use of basic path descriptors (i.e. polygon) to css clip paths.
Implemented multithreaded request signal handling for the Abort API. Please see implementation notes below.
Updated the included US-English dictionary, adding approximately 2500 additional words.
Removed the DOM battery API. This was already disabled for privacy reasons for a long while.
Fixed an erroneous warning displayed on toolkit-only add-ons like supplied dictionaries.
Fixed an issue with the sessionstore tab load preference.
Improved the generation of the names of downloaded files to prevent confusion. (CVE-2020-15658)
Fixed a code issue with base64 encoding of data.
Fixed 2 safety hazards in JavaScript. (One being CVE-2020-15656) DiD
Fixed a spec compliance issue with regards to the cross-origin loading of scripts. (CVE-2020-15652)
Improved the loading of a system DLL on Windows, preventing low-risk hijacking potential. (CVE-2020-15657) See implementation notes.
Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 defense-in-depth, 15 not applicable.

[dreamer]

Thanks. WASM is now enabled by default so photopea.com works out of the box.

[Stevo]

We now have 28.13.0 in the main repo!

Release notes are here.

This release also will appear in XFCE's preferred browser settings, thanks to work by our fehlix.

[Stevo]

Just finished building and sending 28.14.0 to the main repos. It may take a day or so to appear there, but you can download my upload (378 M) and manually install the debs in it early, too: https://drive.google.com/file/d/1RipEOa ... sp=sharing

Never mind--just got this PM forum message:

You will want to halt your builds and stand by for a point release to fix a crash introduced in the new ResizeObserver.

[Stevo]

28.14.1 now on the way to main repo to fix crashiness introduced with new feature in 2.14.0.

Early birds can download and install the deb from this 378 M zip: https://drive.google.com/file/d/1ugLH9K ... sp=sharing

[Stevo]

Updated to 28.14.2 in the main repo to stop more crashes due to that same new feature.