Subject: CVS commit: pkgsrc/www/firefox
From: Ryo ONODERA
Date: 2024-10-29 15:33:40
Message id: 20241029143340.E0797FC7E@cvs.NetBSD.org

Log Message:
www/firefox: Update to 132.0

Changelog:
132.0:
New

  * Microsoft PlayReady encrypted media playback is now being rolled out to
    select sites on Windows. Through this support, we are gradually rolling out
    a 1080p baseline and 4K Ultra HD support with key streaming partners. An
    added benefit is that viewers get less battery drain and better performance
    when streaming their favorite movies and shows.

    This feature is part of a progressive roll out.

  * Wide Color Gamut WebGL is now available for Windows and macOS users! With
    this support, Firefox is bringing a richer, more vivid range of colors to
    the videos, games, and images on your screen. This implementation currently
    supports wider color (P3) profiles in 8-bit.

  * WebRender hardware accelerated rendering is now enabled for most SVG filter
    primitives, improving performance for certain graphics-heavy content.
    Accelerated filters are feBlend, feColorMatrix, feComponentTransfer,
    feComposite, feDropShadow, feFlood, feGaussianBlur, feMerge and feOffset.

  * Added support for macOS?? new screen and window sharing selection features
    on macOS 15 and later. Support for macOS 14 will be added in a future
    release.

  * The macOS session resume feature has been enhanced. Firefox will now
    automatically relaunch if it was open before a system restart, like after
    an OS update.

  * Firefox now blocks third-party cookie access when Enhanced Tracking
    Protection's Strict mode is enabled.

Fixed

  * Various security fixes.

Changed

  * As a follow-up to our work to upgrade mixed content starting with Firefox
    127, HTTP-favicons will now also be blocked if they can not be received
    over HTTPS instead.

  * The Copy Without Site Tracking option is now grayed out when no known
    tracking parameters are found within the link. Additionally, more tracking
    parameter support has been added for websites such as LinkedIn and Shopee.
    Please report tracking parameters that aren't removed by filing a bug in
    Bugzilla.

Security fixes:
Mozilla Foundation Security Advisory 2024-55
#CVE-2024-10458: Permission leak via embed or object elements
#CVE-2024-10459: Use-after-free in layout with accessibility
#CVE-2024-10460: Confusing display of origin for external protocol handler
 prompt
#CVE-2024-10461: XSS due to Content-Disposition being ignored in multipart/
 x-mixed-replace response
#CVE-2024-10462: Origin of permission prompt could be spoofed by long URL
#CVE-2024-10463: Cross origin video frame leak
#CVE-2024-10468: Race conditions in IndexedDB
#CVE-2024-10464: History interface could have been used to cause a Denial of
 Service condition in the browser
#CVE-2024-10465: Clipboard "paste" button persisted across tabs
#CVE-2024-10466: DOM push subscription message could hang Firefox
#CVE-2024-10467: Memory safety bugs fixed in Firefox 132, Thunderbird 132,
 Firefox ESR 128.4, and Thunderbird 128.4

Files:
RevisionActionfile
1.613modifypkgsrc/www/firefox/Makefile
1.545modifypkgsrc/www/firefox/distinfo
1.24modifypkgsrc/www/firefox/files/node-wrapper.sh
1.4modifypkgsrc/www/firefox/patches/patch-netwerk_protocol_http_nsHttpHandler.cpp
1.1removepkgsrc/www/firefox/patches/patch-security_nss_lib_freebl_mpi_mpi.c